Bug 2559278 (CVE-2026-115349) - CVE-2026-115349 mistune: mistune: Denial of Service via deeply nested square brackets
Summary: CVE-2026-115349 mistune: mistune: Denial of Service via deeply nested square ...
Keywords:
Status: NEW
Alias: CVE-2026-115349
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2560125 2560126 2560127 2560128 2560129 2560130 2560131
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-22 20:03 UTC by OSIDB Bzimport
Modified: 2026-10-23 17:48 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-22 20:03:15 UTC 
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
Note You need to log in before you can comment on or make changes to this bug.