---
id: CVE-2026-115349
title: Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
summary: >-
  Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of
  service vulnerability in the parse_link_text function in
  src/mistune/helpers.py. Attackers can submit markdown with deeply nested
  square brackets triggering qua…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-1333
vendor: lepture
product: mistune
affected:
  - mistune >= 3.0.0 < 3.3.0
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:13:26.171Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115349'
references:
  - url: 'https://github.com/lepture/mistune/security/advisories/GHSA-3q64-rw38-243v'
    label: GitHub Security Advisory (GHSA-3q64-rw38-243v)
  - url: >-
      https://www.vulncheck.com/advisories/mistune-3.0.0-before-3.3.0-denial-of-service-via-nested-bracket-parsing
    label: >-
      VulnCheck Advisory: Mistune 3.0.0 before 3.3.0 Denial of Service via
      Nested Bracket Parsing
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.395Z'
---

## Overview

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.

## Affected

- `mistune >= 3.0.0 < 3.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.