CVE-2026-121438 Details
Description
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering repeated _contains_nested_link scans that exhaust CPU in parsing applications.
A denial-of-service vulnerability has been identified in Mistune versions prior to 3.3.3. The issue resides in the InlineParser's link parsing function, where attackers can cause significant CPU exhaustion by sending crafted Markdown with balanced nested brackets that do not form valid links. This manipulation triggers repeated scans for nested links, leading to quadratic CPU growth in applications that parse untrusted Markdown with Mistune's default settings.
Users are advised to upgrade to Mistune version 3.3.3 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lepture/mistune/security/advisories/GHSA-47p6-w2rc-5qf7 | CISA-ADP | AdvisoryExploitRemedy |
| https://github.com/lepture/mistune/commit/fe02f40faf091f86da9ed62c865f31e11da111d7 | [email protected] | Source CodeVendor |
| https://github.com/lepture/mistune/security/advisories/GHSA-47p6-w2rc-5qf7 | [email protected] | AdvisoryExploitRemedy |
| https://www.vulncheck.com/advisories/mistune-before-3.3.3-denial-of-service-via-balanced-bracket-link-parsing | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mistune | < 3.3.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |