A denial‑of‑service vulnerability exists in the Mistune Markdown parser caused by quadratic‑time processing within the parse_link_text function. The parser repeatedly applies a regular expression search in a loop, re‑scanning large portions of the remaining input on each iteration. When an attacker supplies Markdown that contains many consecutive '[' characters, the parser consumes excessive CPU time, potentially exhausting system resources and disrupting service. The flaw is classified as CWE‑1333, CWE‑400, CWE‑407, and CWE‑770.

The affected product is Mistune from the lepture vendor. All versions prior to 3.3.0 vulnerable. Any application that imports Mistune to render user‑supplied or untrusted Markdown may be susceptible.

The CVSS score of 8.7 indicates high severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score of 0.00253 (<1%) indicates a very low exploitation probability, but an attacker can still trigger the denial‑of‑service by sending a small payload of many consecutive '[' characters. Exploitation is likely possible from a remote attacker by delivering a crafted Markdown document to an application that parses the content. The attacker only needs to supply a small payload containing multiple '[' characters to trigger the quadratic‑time behavior, leading to intense CPU usage and possible service interruption.