# CVE-2026-115348: Mistune algorithmic complexity DoS in inline link parser

Source: https://junglewise.ai/threats/cve-2026-115348-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-115348 · Severity: high · CVSS 7.5 · Published 2026-10-22

Mistune is a Markdown parser library used to convert user-supplied Markdown documents into HTML. A flaw in its link parsing causes it to spend quadratic time on inputs with many unbalanced brackets, allowing an attacker to exhaust CPU resources by submitting small Markdown files that tie up server processes for minutes. This can degrade or deny service to legitimate users.

Technologies: [Lepture Mistune](https://junglewise.ai/threats/technologies/lepture-mistune). Vendors: [Lepture](https://junglewise.ai/threats/vendors/lepture).

## Quick answers

**Is CVE-2026-115348 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115348 being exploited in the wild.

**How severe is CVE-2026-115348?** High severity, with a CVSS score of 7.5, published 22 October 2026.

**Which products and versions are affected?** Lepture Mistune 3.0.0 through 3.2.1.

**Is there a fix for CVE-2026-115348?** Yes: fixed in 3.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115348 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115348?** Check whether you run Lepture Mistune at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.3.0

## Technical details

The parse_link_text function in mistune's inline parser falls back to an unbounded bracket-scanning loop when the fast path fails on unbalanced brackets, resulting in O(n²) time complexity for n consecutive opening brackets. Each parsing attempt re-scans the remaining input, causing repeated work. The vulnerability is reachable from all documented entry points and requires no authentication or user interaction beyond submitting Markdown text.

## Affected products

- lepture mistune 3.0.0 through 3.2.1

## Timeline

- 2026-06-21: disclosed
- 2026-10-22: advisory

## References

- [https://github.com/lepture/mistune/security/advisories/GHSA-x2gr-6qf2-fc9x](https://github.com/lepture/mistune/security/advisories/GHSA-x2gr-6qf2-fc9x)
- [https://www.vulncheck.com/advisories/mistune-before-3.3.0-quadratic-time-dos-via-parse-link-text](https://www.vulncheck.com/advisories/mistune-before-3.3.0-quadratic-time-dos-via-parse-link-text)

## Related threats

- [Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187)
- [Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in)
- [Mistune path traversal in Include directive](https://junglewise.ai/threats/cve-2026-115354-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in)
- [Mistune path traversal in RST include directive](https://junglewise.ai/threats/cve-2026-115353-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in)
- [Mistune algorithmic complexity DoS in inline link parser](https://junglewise.ai/threats/cve-2026-115352-mistune-before-3-3-0-contains-an-algorithmic-complexity)