Mistune EUVD-2026-108416

The application must pass attacker-influenced markdown to mistune.html() (or an equivalent mistune parse entry point) on the server side - e.g. rendering comment fields, web-form content, federated/user-generated content, or markdown pulled from an external feed. No special configuration or feature flag is required: the quadratic behavior occurs in the default parse_link_text path against any affected version (3.2.0, 3.2.1, and main up to the 3.3.0 fix). The practical limiting factor is exposure, not configuration - deployments that only render trusted/first-party markdown (as the reporter notes for their own Celery task) have low direct risk, while any surface accepting untrusted markdown is directly affected. No authentication or user interaction is needed per the supplied CVSS vector (PR:N/UI:N).

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) reflects an attack that is network-reachable, low-complexity, and requires no privileges or user interaction - trivially triggerable. However, the impact is strictly availability (VA:H; VC:N/VI:N - no confidentiality or integrity loss), so this is a denial-of-service issue, not a code-execution or data-exposure one. A working proof-of-concept exists in the GHSA advisory with measured timings (quadratic growth: 25 KB of brackets stalls a worker past 15 seconds, 50 KB to ~2 minutes), confirming the quadratic blowup is real and reliably reproducible. vuln.today assigns a 'this_week' priority label, consistent with a readily-exploitable but non-critical-impact bug. No EPSS score and no SSVC exploitation/automatable/technical-impact fields were supplied, so those signals cannot be weighed; the vulnerability is NOT in CISA KEV and there is no evidence of active exploitation. Net: a genuine, easy-to-trigger DoS whose real-world severity is bounded by exposure - it only matters where an attacker can get influenced markdown into a server-side mistune.html() call. The high CVSS is driven by the clean network/no-auth vector rather than by broad or severe impact, so treat it as a real but scoped availability priority rather than an emergency.

An attacker submits a markdown payload consisting of a long run of unmatched '[' characters followed by a single 'x' and matching ']' characters (e.g. via a comment field, web form, or federated/external feed) to an application that renders it server-side with mistune.html(). Each opening bracket triggers a full forward scan in parse_link_text, producing N scans of an N-character input (quadratic time) that pins a worker process for seconds to minutes per request. A working PoC with timing output is published in the GHSA advisory, demonstrating the stall with inputs as small as ~25 KB.