The vulnerability resides in Mistune before 3.3.0, where the parse_link_text function uses an inefficient quadratic algorithm. When an attacker supplies markdown containing long runs of unmatched square brackets, the parser repeatedly performs forward scans, causing the host process to hang for minutes. This results in a denial of service affecting the availability of the application or web service that renders markdown.

The affected product is Mistune, the popular Python markdown parser. Versions prior to 3.3.0, as identified by the mistune_project CPE, are vulnerable. Any installation of Mistune before that release that processes user‑supplied markdown is at risk.

The CVSS score of 8.7 indicates high severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV, but the attack surface is remote: a malicious user can submit crafted markdown to any endpoint that uses mistune.html(). The exploit requires no special privileges and can be executed over HTTP or other transport, leading to applications becoming unresponsive for minutes.