Bug 2559327 (CVE-2026-115347)

Summary: CVE-2026-115347 mistune: mistune: Denial of Service via unmatched square brackets
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, sghai, sidsharm, suppawar, vlaad
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in mistune. A remote attacker can exploit an inefficient algorithmic complexity issue in the link text parsing logic by submitting specially crafted Markdown input containing long sequences of unmatched square brackets. Processing this input causes repeated forward scans, leading to excessive resource consumption and a Denial of Service (DoS) that stalls application worker processes.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2560098, 2560100, 2560102, 2560104, 2560106, 2560108, 2560110    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-22 20:35:29 UTC 
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.