The vulnerability resides in Mistune’s parse_link_text function and causes quadratic time complexity when the input contains deeply nested square brackets. An attacker can submit a small markdown payload that forces the parser to perform O(n^2) operations, consuming excessive CPU resources and causing the application processing the markdown to become unresponsive. The weakness is an example of algorithmic complexity denial of service (CWE-1333) with additional unchecked array access (CWE-606).

Lepture Mistune 3.0.0 through 3.2.x (any release before 3.3.0). This includes any application that imports the Mistune package within that version range, regardless of operating system or deployment environment. The CPE mapping indicates mistune_project:mistune across all platforms.

The CVSS score of 8.7 classifies this issue as high severity. EPSS data is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no confirmed exploits to date. However, because the vulnerability can be triggered by arbitrary markdown input, the attack vector is likely remote, straightforward, and requires no privileged access. The impact could be full application outage or degraded service if the attacker repeatedly sends the crafted payload, making it a significant operational risk for any service that renders untrusted Markdown.