An update for python-mistune is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4792 Final 1.0 1.0 2026-11-11 Initial 2026-11-11 2026-11-11 openEuler SA Tool V1.0 2026-11-11 python-mistune security update An update for python-mistune is now available for openEuler-22.03-LTS-SP4 The python-mistune package is a fast yet powerful Python Markdown parser with renderers and plugins, compatible with sane CommonMark rules. Security Fix(es): Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.(CVE-2026-115347) Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.(CVE-2026-115348) Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.(CVE-2026-115349) Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.(CVE-2026-115352) An update for python-mistune is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High python-mistune https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4792 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-115347 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-115348 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-115349 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-115352 https://nvd.nist.gov/vuln/detail/CVE-2026-115347 https://nvd.nist.gov/vuln/detail/CVE-2026-115348 https://nvd.nist.gov/vuln/detail/CVE-2026-115349 https://nvd.nist.gov/vuln/detail/CVE-2026-115352 openEuler-22.03-LTS-SP4 python-mistune-debuginfo-0.8.3-9.oe2203sp4.aarch64.rpm python-mistune-debugsource-0.8.3-9.oe2203sp4.aarch64.rpm python3-mistune-0.8.3-9.oe2203sp4.aarch64.rpm python-mistune-debuginfo-0.8.3-9.oe2203sp4.x86_64.rpm python-mistune-debugsource-0.8.3-9.oe2203sp4.x86_64.rpm python3-mistune-0.8.3-9.oe2203sp4.x86_64.rpm python-mistune-0.8.3-9.oe2203sp4.src.rpm Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes. 2026-11-11 CVE-2026-115347 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-mistune security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4792 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes. 2026-11-11 CVE-2026-115348 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-mistune security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4792 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests. 2026-11-11 CVE-2026-115349 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-mistune security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4792 Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input. 2026-11-11 CVE-2026-115352 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-mistune security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4792