CVE-2026-115352
7.5 HIGHpublic exploit availablePublished 2026-10-22 · Updated 2026-10-23
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-407
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100700PoC
- HIGHCVE-2026-101021PoC
- MEDIUMCVE-2026-102277PoC
- MEDIUMCVE-2026-102461PoC
- HIGHCVE-2026-102994PoC
- HIGHCVE-2026-102997PoC
- HIGHCVE-2026-102999PoC
- UNSCOREDCVE-2026-103604PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.