The vulnerability resides in the inline link parser’s parse_link_text function within Mistune 3.x, where an aggressive algorithmic complexity allows unauthenticated users to consume extensive CPU time by submitting Markdown containing many unbalanced '[' or '![' characters. The parser repeatedly scans the text, resulting in exponential processing time and tying up worker processes for minutes. This behavior enables a denial‑of‑service attack that can be launched without credentials, exploiting CWE‑400 Resource Exhaustion and CWE‑606 Unchecked Input for Security‑Related Parameter.

Affected versions are Mistune 3.0.0 through 3.2.x inclusive. The product is Mistune from the Mistune project. Users deploying any of those releases within a web application, CMS, or other service that renders user supplied Markdown are vulnerable until the fix is applied.

The CVSS score of 8.7 classifies this flaw as High severity, and the absence of an EPSS score means exploitation probability is unknown but could be significant when the flaw is widely used. Since the vulnerability is not listed in CISA’s KEV catalog, there are currently no known exploits in the wild. Nevertheless, the attack vector is local to the Markdown rendering service and does not require authentication, making it trivial for an attacker who can send crafted Markdown to a vulnerable endpoint to initiate a DoS. Mitigating actions should therefore focus on patching and input restrictions to reduce the risk, addressing both CWE‑400 Resource Exhaustion and CWE‑606 Unchecked Input for Security‑Related Parameter.