Read the docs
TI-2026-79435 Aliases CVE-2026-115348GHSA-h98w-84rc-h77q

Quadratic-time denial of service in Mistune via parse_link_text

Priority MEDIUM 44CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity flaw in the inline link parser's parse_link_text function that lets unauthenticated remote attackers exhaust CPU. Attackers can submit Markdown with many unbalanced brackets, causing repeated unbounded scans that tie up worker processes for minutes (CWE-400).

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00438 38th percentileScored 2026-11-07
Fix Partial mistune (lepture): 3.3.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lepturemistune3.0.0 to before 3.3.03.3.0Patch availableCNA
  • mistune Vendorlepture Affected 3.0.0 to before 3.3.0 Fixed in 3.3.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*——lepture
  • cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:* Versions — — ·lepture

Remediation

Upgrade lepture mistune to version 3.3.0. Red Hat OpenShift AI (RHOAI) is affected without a fix, and Red Hat has no plan for one yet.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA mistune (lepture) Fixed in 3.3.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    lepture mistune 3.3.0

    9 records Highest priority Priority HIGH 1 HIGH, 7 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-79440 Path traversal in Mistune include directive lets attackers read filesPriority HIGH 79
    • TI-2026-79441 Path traversal in Mistune lets attackers read local filesPriority MEDIUM 64
    • TI-2026-79438 CSS injection in Mistune figure directive figwidth optionPriority MEDIUM 57
    Show all 9 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Not affected: 2 products
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-115348
  2. 2026-10-22 Alias added: GHSA-h98w-84rc-h77q
  3. 2026-10-23 Affected versions changed · Red Hat
  4. 2026-10-23 CVSS score added · Red Hat
  5. 2026-10-23 Priority changed: MEDIUM → LOW
  6. 2026-10-24 CISA SSVC decision points changed
  7. 2026-10-24 Priority changed: LOW → MEDIUM
  8. 2026-11-02 Affected versions changed · Red Hat

References

Advisory 1

  • TI-2026-79440 Path traversal in Mistune include directive lets attackers read files CVSS 4.0CRITICAL 9.2
  • TI-2026-36755 Mistune: Potential DoS via quadratic-time parsing in parse_link_text CVSS 4.0HIGH 8.7
  • TI-2026-25521 Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles CVSS 4.0HIGH 8.7
  • TI-2026-53257 Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown CVSS 3.1HIGH 7.5
  • TI-2026-42736 Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions CVSS 3.1HIGH 7.5
  • TI-2026-42730 Regular expression denial of service in lepture mistune CVSS 3.1HIGH 7.5
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences