Amazon Linux 2023 Security Advisory: ALAS2023-2026-3386
Advisory Released Date: 2026-11-09
Advisory Updated Date: 2026-11-09
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes. (CVE-2026-115347)
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input. (CVE-2026-115352)
Affected Packages:
python-mistune
Issue Correction:
Run dnf update python-mistune --releasever 2023.12.20261109 or dnf update --advisory ALAS2023-2026-3386 --releasever 2023.12.20261109 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
python3-mistune-debuginfo-0.8.3-14.amzn2023.0.5.aarch64
python-mistune-debugsource-0.8.3-14.amzn2023.0.5.aarch64
python3-mistune-0.8.3-14.amzn2023.0.5.aarch64
src:
python-mistune-0.8.3-14.amzn2023.0.5.src
x86_64:
python3-mistune-debuginfo-0.8.3-14.amzn2023.0.5.x86_64
python-mistune-debugsource-0.8.3-14.amzn2023.0.5.x86_64
python3-mistune-0.8.3-14.amzn2023.0.5.x86_64