Description (CNA)
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| lepture / mistune | affected 0 before 3.3.0; unaffected 3.3.0 |
CWE
CWE-407
References
- https://github.com/lepture/mistune/security/advisories/GHSA-xrpv-r66x-8p7j
- https://www.vulncheck.com/advisories/mistune-before-3.3.0-quadratic-time-dos-via-unmatched-brackets-in-inline-parser
ADP enrichment
No English description supplied.
No references supplied.