MEDIUM 6.9 NVD
CVE-2026-121438
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to cause quadratic CPU growth by supplying bala
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering repeated _contains_nested_link scans that exhaust CPU in parsing applications.
References
- https://github.com/lepture/mistune/commit/fe02f40faf091f86da9ed62c865f31e11da111d7
- https://github.com/lepture/mistune/security/advisories/GHSA-47p6-w2rc-5qf7
- https://www.vulncheck.com/advisories/mistune-before-3.3.3-denial-of-service-via-balanced-b
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.