CVE-2026-121438

Medium

Description

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering repeated _contains_nested_link scans that exhaust CPU in parsing applications.

SeverityMedium

CVSS5.3

Exploit probability—

ProductLepture Mistune

PublishedNov 3, 2026

First seenNov 4, 2026

Weakness typeCWE-400Uncontrolled resource consumption

How to fix

Update

lepture mistune3.3.3 or later

Patches

github.com/lepture/mistune/commit/fe02f40faf091f86da9ed62c865f31e11da111d7

Vendor advisories

github.com/lepture/mistune/security/advisories/GHSA-47p6-w2rc-5qf7

Affected products

Product	Affected versions	Fixed in
lepture mistune	v < 3.3.3	3.3.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.