Bug 2559327 (CVE-2026-115347) - CVE-2026-115347 mistune: mistune: Denial of Service via unmatched square brackets
Summary: CVE-2026-115347 mistune: mistune: Denial of Service via unmatched square brac...
Keywords:
Status: NEW
Alias: CVE-2026-115347
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2560098 2560100 2560102 2560104 2560106 2560108 2560110
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-22 20:35 UTC by OSIDB Bzimport
Modified: 2026-10-23 17:40 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-22 20:35:29 UTC 
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
Note You need to log in before you can comment on or make changes to this bug.