EUVD-2026-108421
GHSA-84gc-h84g-h8g5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit small markdown payload of unmatched '[' brackets
-
ExploitInline link parser probes every bracket O(N^2)
-
ExecutionRendering worker CPU pegged 30+ seconds
-
ImpactRepeat to exhaust worker pool and deny service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Exploitable only when an application uses mistune (<= 3.2.1) to render attacker-supplied markdown to HTML server-side; the advisory states the default configuration is sufficient with no plugins or special options required. The concrete trigger is a long run of unmatched '[' characters (or nested '[[..]]', which carries a ~4x constant-factor penalty) that forces parse_link_text/parse_link_label to probe from every bracket position. Limiting factors for defenders: the app must accept and render multi-KB untrusted markdown, impact is CPU-time only (no memory growth, no data impact), and because it ties up one worker per request, sustained denial requires repeated requests to exhaust a thread/worker pool (a single request is a per-request stall, most impactful on single-threaded WSGI deployments). |
| Impact | This is a genuine but bounded availability risk, not a confidentiality/integrity emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated trigger with no user interaction, and impact is isolated to availability (VC:N/VI:N/VA:H) - consistent with the CWE-407/CWE-1333 algorithmic-complexity DoS described. The GHSA advisory includes a verified PoC (run against mistune@3.2.1) demonstrating O(N^2) scaling, so publicly available exploit code exists; however, there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active exploitation - treat exploit maturity as 'PoC available, exploitation not confirmed.' The vuln.today Decision label is 'this_week' (not act_now/emergency), which aligns with a serious-but-non-critical DoS: easy to trigger and repeatable, but it only exhausts CPU (no data exposure, no code execution, no memory growth). Note one labeling conflict to flag: the input Tags list 'Information Disclosure,' which contradicts both the description and the CVSS vector (VC:N/VI:N, VA:H) - this is an availability/DoS issue, not information disclosure. Overall: a real priority for any service rendering untrusted markdown server-side, but severity is driven entirely by availability. |
| Exploit ScenarioDerived | An attacker submits a small (~16 KB) markdown payload consisting of a long run of unmatched '[' characters (or nested '[[..]]') into any field an application renders with mistune - a comment box, wiki page, issue tracker, or chat message. When the server calls mistune to render it, the inline link parser performs O(N^2) probing and pegs a rendering worker's CPU for 30+ seconds per request (≈120 s at 32 KB), and the attacker repeats requests to exhaust the worker pool and deny service. A working proof-of-concept demonstrating this scaling is published in the GHSA advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Quadratic-time parsing in Mistune's inline link parser (all versions through 3.2.1) lets remote attackers stall server-side markdown rendering by submitting a small payload made of long runs of unmatched '[' characters. Each '[' triggers a probe of parse_link_text/parse_link_label, so work grows O(N^2): roughly 30+ seconds of CPU for a 16 KB input and proportionally worse as input grows, with the nested '[[..]]' shape costing a further ~4x. The vendor advisory reports a reproducible benchmark proof-of-concept against mistune 3.2.1 in default configuration (no plugins or options required); there is no CISA KEV listing and no confirmed in-the-wild exploitation, and the impact is CPU time only - no memory growth, no confidentiality or integrity effect - so sustained denial requires repeated requests to exhaust a worker or thread pool, most acutely on single-threaded WSGI deployments.
RemediationAI
Vendor-released patch: 3.3.0 - upgrade Mistune from <= 3.2.1 to 3.3.0 or later, per GHSA-xrpv-r66x-8p7j (https://github.com/lepture/mistune/security/advisories/GHSA-xrpv-r66x-8p7j); the advisory also lists https://www.vulncheck.com/advisories/mistune-before-3.3.0-quadratic-time-dos-via-unmatched-brackets-in-inline-parser. The fix removes the quadratic behaviour either by capping the number of unmatched '[' the parser tracks simultaneously (the advisory's surgical option, treating surplus brackets as literal text) or by replacing the per-bracket retry loop with a single-pass CommonMark-style delimiter stack; a regression test asserting that 50,000 consecutive '[' parse in under a second accompanies the change. Where upgrading cannot be done immediately, the exploitable precondition identified in the assessment is that the application accepts and renders multi-KB untrusted markdown server-side, so bounding accepted markdown field length and moving rendering into a worker pool with request timeouts limits the per-request stall - noting these reduce exposure without removing the parser-level quadratic, and a single request can still occupy a worker on a single-threaded WSGI deployment until the patched release is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-407 (inefficient algorithmic complexity), with the advisory also tagging CWE-1333 for the regex-adjacent aspects. The flaw sits in Mistune's inline parser dispatch (src/mistune/inline_parser.py): every '[' in the input is treated as a candidate link or image start, and each candidate position calls parse_link_text into parse_link_label. The LINK_LABEL pattern in src/mistune/helpers.py is itself bounded per call (r"(?:[^\\\[\]]|\\.){0,500}"), so a single match is cheap - the cost is in the calling loop, which never memoises failed label positions or caps the number of bracket-start attempts. For N consecutive '[' with no matching ']' (or N '[' followed by N ']'), the parser performs up to O(N) forward scanning from each of N positions. The CommonMark reference parser avoids this with a delimiter stack that resolves in a single O(N) pass; this is a sibling class to the previously fixed catastrophic-backtracking bug GHSA-fw3v-x4f2-v673, which changed a regex but left the surrounding parser-level quadratic in place. Memory consumption is not the vector; the cost is pure CPU occupancy of the rendering worker.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, no interaction against default config (AV:N/AC:L/PR:N/UI:N); impact is CPU-exhaustion DoS only, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
Executive ViewAI
Mistune, a widely used markdown rendering library embedded in many Python web applications, can be tied up for tens of seconds of CPU per request by a tiny, crafted input under all versions through 3.2.1. Any service that renders untrusted markdown server-side in its default configuration, especially single-threaded WSGI deployments, could see user-facing slowdowns or outages from repeated small requests. Leadership should care because the barrier to abuse is low and the affected component is often buried deep in the dependency stack, meaning the application inventory may not make it obvious which customer-facing services are exposed.
No vendor-released patch identified at time of analysis. Interim mitigations: cap the length of markdown inputs before rendering and reject pathological runs of unmatched brackets, enforce request body size and per-client rate limits at the gateway, set strict request timeouts and worker concurrency limits in the application server, and add capacity or shielding in front of single-threaded WSGI deployments to absorb CPU-bound requests.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB