# CVE-2026-115347: Mistune parse_link_text quadratic denial of service

Source: https://junglewise.ai/threats/cve-2026-115347-mistune-before-3-3-0-contains-an-inefficient-algorithmic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-115347 · Severity: high · CVSS 7.5 · Published 2026-10-22

Mistune is a Python markdown parser library used to convert user-supplied markdown into HTML. An attacker can craft markdown with unbalanced square brackets to trigger quadratic-time parsing, causing the parser to stall for minutes and exhaust server resources. This affects any web service that processes user-supplied markdown through Mistune, including comment systems, federated content platforms, and form processors.

Technologies: [Lepture Mistune](https://junglewise.ai/threats/technologies/lepture-mistune). Vendors: [Lepture](https://junglewise.ai/threats/vendors/lepture).

## Quick answers

**Is CVE-2026-115347 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115347 being exploited in the wild.

**How severe is CVE-2026-115347?** High severity, with a CVSS score of 7.5, published 22 October 2026.

**Which products and versions are affected?** Lepture Mistune before 3.3.0.

**Is there a fix for CVE-2026-115347?** Yes: fixed in Mistune 3.3.0. Until then: Cap the forward scan distance in parse_link_text similar to the existing LINK_LABEL pattern limit to prevent quadratic rescanning of large inputs. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115347 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115347?** Check whether you run Lepture Mistune at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Mistune 3.3.0

Cap the forward scan distance in parse_link_text similar to the existing LINK_LABEL pattern limit to prevent quadratic rescanning of large inputs.

## Technical details

The vulnerability is an algorithmic complexity flaw (CWE-407) in the parse_link_text function. When processing unbalanced square brackets in a pattern like "[" × N + "x" + "]" × N, the parser performs N full forward scans of the input, resulting in O(N²) time complexity. Each opening bracket triggers a new parse_link_text call that rescans the entire remaining string to balance brackets. An attacker can submit markdown containing thousands of unmatched brackets to mistune.html() and cause worker processes to stall for extended periods.

## Affected products

- lepture Mistune before 3.3.0

## Timeline

- 2026-06-21: disclosed: GitHub advisory GHSA-f32h-38gf-rg5r published
- 2026-10-22: advisory: CVE-2026-115347 assigned
- 2026: patched: Fixed in version 3.3.0

## References

- [https://github.com/lepture/mistune/security/advisories/GHSA-f32h-38gf-rg5r](https://github.com/lepture/mistune/security/advisories/GHSA-f32h-38gf-rg5r)
- [https://www.vulncheck.com/advisories/mistune-before-3.3.0-quadratic-denial-of-service-via-parse-link-text](https://www.vulncheck.com/advisories/mistune-before-3.3.0-quadratic-denial-of-service-via-parse-link-text)

## Related threats

- [Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187)
- [Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in)
- [Mistune path traversal in Include directive](https://junglewise.ai/threats/cve-2026-115354-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in)
- [Mistune path traversal in RST include directive](https://junglewise.ai/threats/cve-2026-115353-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in)
- [Mistune algorithmic complexity DoS in inline link parser](https://junglewise.ai/threats/cve-2026-115352-mistune-before-3-3-0-contains-an-algorithmic-complexity)