Key points
- CVE-2026-115352 affects Mistune versions before 3.3.0.
- The flaw allows unauthenticated attackers to exhaust CPU resources.
- A fix is available in version 3.3.0.
The Python library Mistune versions before 3.3.0 contain a high-severity algorithmic complexity vulnerability. According to the National Vulnerability Database, this flaw is tracked as CVE-2026-115352. It has a CVSS score of 8.7, which classifies it as high severity. The issue resides in the inline link parser component of the software.
In plain English
Attackers can exploit this weakness by sending small Markdown files to systems using the vulnerable library. These files contain long sequences of unmatched square bracket characters. When the parser processes these inputs, it enters a loop that consumes excessive processing power. This causes the system to become unresponsive or significantly slower.
The background
The vulnerability is categorized under CWE-407, which relates to algorithmic complexity issues. The specific problem occurs in the functions responsible for parsing link text and link labels. These functions perform probing that scales quadratically with input size. This means processing time increases dramatically as the input grows, even if the file itself is small.
What changes now
The vendor has released version 3.3.0 to address this issue. Systems currently running older versions of Mistune are exposed to this denial-of-service risk. Upgrading to the patched version removes the algorithmic inefficiency in the link parser. Teams should verify their current library versions against the affected range.
Who needs to act first
Security teams should prioritize updating systems that process untrusted Markdown input from external users. Identify applications that accept user-generated content and render it using Mistune. Update these critical systems first to prevent service disruption. Test the new library version in a staging environment before deploying to production. Ensure you have backups of your application configurations before making changes. Monitor system performance metrics after the update to confirm stability.
What to do and how to stay safe: Mistune
- Audit your application dependencies to identify if you are using Mistune versions prior to 3.3.0.
- Upgrade the library to version 3.3.0 or later to apply the vendor-provided fix.
- Implement input validation to reject Markdown documents containing excessive special characters.
- Monitor server CPU usage for spikes that may indicate an ongoing exploitation attempt.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Mistune are affected by this vulnerability?
Versions of Mistune before 3.3.0 are affected by CVE-2026-115352.
What is the CVSS score for this issue?
The National Vulnerability Database rates this vulnerability at 8.7, which is high severity.
How do attackers exploit this flaw?
Attackers submit small Markdown payloads with long runs of unmatched brackets to exhaust CPU.
