EUVD-2026-115860
GHSA-296h-qmjr-9mv2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted Markdown to parsing endpoint
-
ExploitBalanced nested brackets bypass no_close_bracket mitigation
-
ExecutionRepeated quadratic _contains_nested_link substring scans
-
ImpactCPU exhaustion degrades or blocks service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a downstream application or job to pass attacker-controlled Markdown into Mistune's default parser via mistune.create_markdown()(text) or mistune.html(text); no special plugin, non-default renderer, authentication, or user interaction is needed, and default configurations are affected. The trigger is specific: a balanced but invalid-link payload '[' * n + 'x' + ']' * n with thousands of bracket pairs, which defeats the existing state.no_close_bracket_before mitigation (that guard only covers unmatched brackets). Limiting factors for defenders: Mistune is a library, so network exposure depends entirely on whether the host application accepts untrusted Markdown; the impact is bounded to CPU exhaustion / availability degradation with no data or integrity consequences. |
| Impact | This is a moderate-severity, availability-only denial of service. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 and shows only a vulnerable-system availability impact (VA:L) with no confidentiality or integrity effect (VC:N/VI:N) and no scope change (SC:N/SI:N/SA:N), which is consistent with the CWE-400/CWE-407 algorithmic-complexity nature of the bug. The signals are coherent rather than conflicting: the flaw is network-reachable and unauthenticated in principle, but the GHSA advisory explicitly notes Mistune is a library, so real exposure exists only where a downstream application or job feeds attacker-controlled Markdown to the default parser - this is the key factor that tempers the AV:N rating. No CISA KEV listing is present and no EPSS score is provided in the input, so there is no evidence of active or widespread exploitation; a verified reproduction PoC does exist in the GHSA advisory. The vuln.today decision label is 'this_month' (not act_now/emergency), matching a patchable medium-impact DoS. Net: a real, worth-patching issue for services that render untrusted Markdown, but not a drop-everything emergency - the impact is CPU degradation, not compromise. |
| Exploit ScenarioDerived | An attacker submits a small crafted Markdown payload of the form '[' * n + 'x' + ']' * n (thousands of balanced bracket pairs forming no valid link) to any endpoint that renders untrusted Markdown with Mistune's default parser - e.g. a comment box, issue tracker, or documentation-rendering job. Because each outer '[' triggers a fresh large _contains_nested_link substring scan, parsing time grows roughly quadratically, so a few kilobytes of input consume seconds of CPU and can stall request handlers or background workers. A verified reproduction PoC is published in the GHSA advisory, confirmed against the 3.3.2 release. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Quadratic CPU consumption in Mistune's inline link parser allows unauthenticated remote attackers to degrade availability by submitting crafted Markdown containing thousands of balanced nested bracket pairs that never resolve into a valid link. Every version prior to 3.3.3 is affected, and exploitation only requires that a downstream application or background job pass attacker-controlled Markdown into the default parser (mistune.create_markdown() or mistune.html()); no plugin, non-default renderer, or user interaction is involved. The impact is availability-only (no confidentiality or integrity loss), but a small input of tens of kilobytes can pin a request handler or worker for seconds, and a public proof-of-concept reproducer included in the vendor advisory was verified against the 3.3.2 release tag. The issue is not listed as actively exploited in CISA KEV, and no EPSS score was supplied with the source data.
RemediationAI
Upgrade to Mistune 3.3.3 or later (for example pip install 'mistune>=3.3.3'); this is the complete fix per the vendor advisory and is delivered by commit fe02f40faf091f86da9ed62c865f31e11da111d7, which introduces the state.no_link_before high-water mark so failed balanced link candidates are not re-scanned and the parser scales approximately linearly, and which also raises the regression test from 200 to 8000 bracket pairs. Where immediate upgrade is not possible, the exposure is confined to code paths that hand untrusted Markdown to the default parser, so the practical controls are to cap the size and bracket-nesting depth of Markdown accepted from untrusted sources before it reaches Mistune (side effect: long or deeply nested but legitimate documents are rejected or truncated), and to run parsing in bounded workers with request timeouts so a single pathological document cannot occupy a request handler indefinitely (side effect: timed-out renders fail and must be retried or dropped). Detail on the fix and affected range is at https://github.com/lepture/mistune/security/advisories/GHSA-47p6-w2rc-5qf7 and https://github.com/lepture/mistune/commit/fe02f40faf091f86da9ed62c865f31e11da111d7.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mistune is a pure-Python Markdown parser, and the flaw lives in src/mistune/inline_parser.py. When the inline parser encounters '[', InlineParser.parse_link treats it as a potential link start; if parse_link_label returns no label, the code falls back to _parse_link_text(), which locates the matching closing bracket and returns the enclosed text. For a balanced payload such as '[' * n + 'x' + ']' * n, the existing fast path guarded by state.no_close_bracket_before does not engage because every '[' has a matching ']'. parse_link then invokes _contains_nested_link() on the extracted body - a set of large substring scans - before it has established that the outer bracket sequence is a real link; since no '(url)' or reference target follows, parse_link returns None, the outer parser advances one character, and the same work repeats on a slightly shorter balanced substring. The result is roughly quadratic growth, classified as CWE-400 (Uncontrolled Resource Consumption) and additionally as CWE-407 (Inefficient Algorithmic Complexity) in the GHSA. The upstream fix adds a no_link_before high-water mark to InlineState and a _mark_no_link_before() helper so that failed balanced link candidates are memoized instead of re-scanned, restoring approximately linear scaling. Affected components are identified by CPE cpe:2.3:a:lepture:mistune. Exploitation requires a downstream application or job that feeds untrusted Markdown to the default parser; because Mistune is a library, concrete network exposure is entirely a property of the host application.
Know when Mistune gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable unauthenticated Markdown input with a simple crafted payload (AV:N/AC:L/PR:N/UI:N); impact is CPU-exhaustion availability degradation only, so A:L with C:N/I:N and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering repeated _contains_nested_link scans that exhaust CPU in parsing applications.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Uncontrolled CPU consumption in Mistune, a Python Markdown parser, allows remote unauthenticated attackers to cause deni
Denial of service in Mistune (the lepture Python Markdown parser) before 3.3.0 lets remote unauthenticated attackers exh
Denial of service in Mistune, a Python Markdown parser, affects all versions prior to 3.3.0 when the strikethrough, mark
Denial of service in Mistune, a widely used pure-Python Markdown parser, affects all versions prior to 3.3.0 where the d
Cross-site scripting in Mistune Python Markdown parser (all versions before 3.3.0) allows attacker-controlled Markdown c
Cross-site scripting in Mistune prior to 3.3.0 stems from an incomplete URI scheme blocklist in the `safe_url` filter, p
mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address,
Path traversal in Mistune's Include plugin allows reading arbitrary files from the server filesystem when processing att
Unbounded recursion in Mistune's Include directive (all versions prior to 3.3.0) can be triggered by a pair of mutually-
Quadratic denial of service in Mistune's Markdown parser (parse_link_text) affects versions 3.2.0, 3.2.1 and main prior
Denial of service in Mistune 3.3.0 through 3.3.3 allows unauthenticated remote attackers to exhaust CPU and stall reques
Predictable heading anchor ID generation in Mistune's toc plugin (all versions prior to 3.3.0) enables same-page navigat
Exploit-DB