Affected: Homebrew: adr-viewer

### Summary Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. A relatively small input consisting of repeated [ characters causes significant parsing slowdown.

### Affected component mistune/inline_parser.py → **parse_link_text**

### Description When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload.

### Root cause The vulnerability stems from a two-loop interaction: - The outer loop in `InlineParser.parse()` (inline_parser.py) advances only 1 character at a time when parse_link() returns None - Each failed attempt calls `parse_link_text()` which performs an O(n) scan to the end of the string looking for a closing `]` - With n consecutive `[` characters, this results in O(n) × O(n) = O(n²) total work

### PoC Run below python script ``` import mistune import time

md = mistune.create_markdown()

s = "[" * 6400

t = time.perf_counter() md(s) print(time.perf_counter() - t) ``` <img width="2028" height="1277" alt="image" src="https://github.com/user-attachments/assets/15d5bc0b-35f8-4a15-85e0-cbc314a45b06" />

**Benmark poc** Run below code for benchmark ``` import mistune import time

md = mistune.create_markd…

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.

Affected: PyPI: mistune

### Summary Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. A relatively small input consisting of repeated [ characters causes significant parsing slowdown.

### Affected component mistune/inline_parser.py → **parse_link_text**

### Description When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload.

### Root cause The vulnerability stems from a two-loop interaction: - The outer loop in `InlineParser.parse()` (inline_parser.py) advances only 1 character at a time when parse_link() returns None - Each failed attempt calls `parse_link_text()` which performs an O(n) scan to the end of the string looking for a closing `]` - With n consecutive `[` characters, this results in O(n) × O(n) = O(n²) total work

### PoC Run below python script ``` import mistune import time

md = mistune.create_markdown()

s = "[" * 6400

t = time.perf_counter() md(s) print(time.perf_counter() - t) ``` <img width="2028" height="1277" alt="image" src="https://github.com/user-attachments/assets/15d5bc0b-35f8-4a15-85e0-cbc314a45b06" />

**Benmark poc** Run below code for benchmark ``` import mistune import time

md = mistune.create_markd…

python311-mistune-3.3.2-1.1 on GA media

Affected: PyPI: mistune

### Summary Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. A relatively small input consisting of repeated [ characters causes significant parsing slowdown.

### Affected component mistune/inline_parser.py → **parse_link_text**

### Description When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload.

### Root cause The vulnerability stems from a two-loop interaction: - The outer loop in `InlineParser.parse()` (inline_parser.py) advances only 1 character at a time when parse_link() returns None - Each failed attempt calls `parse_link_text()` which performs an O(n) scan to the end of the string looking for a closing `]` - With n consecutive `[` characters, this results in O(n) × O(n) = O(n²) total work

### PoC Run below python script ``` import mistune import time

md = mistune.create_markdown()

s = "[" * 6400

t = time.perf_counter() md(s) print(time.perf_counter() - t) ``` <img width="2028" height="1277" alt="image" src="https://github.com/user-attachments/assets/15d5bc0b-35f8-4a15-85e0-cbc314a45b06" />

**Benmark poc** Run below code for benchmark ``` import mistune import time

md = mistune.create_markd…

urllib3: urllib3 Streaming API improperly handles highly compressed data github.com/argoproj/argo-workflows: argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links image-size: image-size: Denial of Service via crafted image buffer with zero-valued size field image-size: image-size: Denial of Service via crafted ICNS image buffer mlflow/mlflow: mlflow/mlflow: Unauthenticated remote code execution via unprotected job endpoints mlflow: mlflow: Arbitrary file read via bypassed source path validation python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability fast-uri: fast-uri: URI authority bypass due to improper delimiter handling undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy form-data: form-data: Form field override via CRLF injection undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames nltk: NLTK: Information disclosure via path traversal vulnerability keras: Keras: Arbitrary code execution via deserialization vulnerability brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity shell-quo…

Security update for python-mistune

Affected: Ubuntu:16.04:LTS: mistune, Ubuntu:18.04:LTS: mistune, Ubuntu:20.04:LTS: mistune, Ubuntu:22.04:LTS: mistune, Ubuntu:24.04:LTS: mistune, Ubuntu:25.10: mistune, Ubuntu:26.04:LTS: mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.