diff --git a/hall_of_fame.md b/hall_of_fame.md
index 09bb1838..1ad556cc 100644
--- a/hall_of_fame.md
+++ b/hall_of_fame.md
@@ -65,6 +65,10 @@ Python offers libraries that can safely parse Python code without executing it.
 
 Certain malicious inputs can cause infinite recursion in Pygments `get_tokens_unprocessed()` function.
 
+### Dos
+[CVE-2026-49851](https://github.com/lepture/mistune/security/advisories/GHSA-qcq2-496w-v96p)
+Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.
+
 ## OSS-Fuzz Bugs
 
 [These bugs](https://bugs.chromium.org/p/oss-fuzz/issues/list?groupby=Proj&colspec=ID%20Type%20Component%20Status%20Reported%20Owner%20Summary&q=%28adal%20OR%20aiohttp%20OR%20airflow%20OR%20ansible%20OR%20asn1crypto%20OR%20bleach%20OR%20bottleneck%20OR%20bs4%20OR%20charset_normalizer%20OR%20coveragepy%20OR%20croniter%20OR%20cryptography%20OR%20dask%20OR%20decorator%20OR%20digest%20OR%20ecdsa-python%20OR%20et-xmlfile%20OR%20filelock%20OR%20flask%20OR%20flask-restx%20OR%20ftfy%20OR%20g-api-auth-httplib2%20OR%20g-api-auth-library-python%20OR%20g-api-pubsub%20OR%20g-api-py-api-common-protos%20OR%20g-api-py-oauthlib%20OR%20g-api-python-client%20OR%20g-api-python-cloud-core%20OR%20g-api-python-firestore%20OR%20g-api-python-tasks%20OR%20g-api-resource-manager%20OR%20g-api-resumable-media-python%20OR%20g-api-secret-manager%20OR%20g-apis-py-api-core%20OR%20gc-iam%20OR%20gcloud-error-py%20OR%20g-cloud-logging-py%20OR%20gcp-python-cloud-storage%20OR%20glom%20OR%20g-py-bigquery%20OR%20g-py-crc32c%20OR%20grpc-py%20OR%20gunicorn%20OR%20idna%20OR%20iniconfig%20OR%20ipython%20OR%20jsmin%20OR%20jupyter_server%20OR%20kafka%20OR%20kiwisolver%20OR%20looker-sdk%20OR%20lxml%20OR%20mako%20OR%20matplotlib%20OR%20msal%20OR%20netaddr-py%20OR%20nfstream%20OR%20ntlm2%20OR%20numpy%20OR%20oauth2%20OR%20oauthlib%20OR%20olefile%20OR%20openpyxl%20OR%20oracle-py-cx%20OR%20orjson%20OR%20pandas%20OR%20paramiko%20OR%20pip%20OR%20protobuf-python%20OR%20psqlparse%20OR%20psycopg2%20OR%20pyasn1%20OR%20pycrypto%20OR%20pydateutil%20OR%20pygments%20OR%20pyjwt%20OR%20pyodbc%20OR%20pyparsing%20OR%20pyrsistent%20OR%20py-serde%20OR%20python-email-validator%20OR%20python-lz4%20OR%20python-rsa%20OR%20python-tabulate%20OR%20pytz%20OR%20pyxdg%20OR%20pyyaml%20OR%20redis-py%20OR%20requests%20OR%20retry%20OR%20scapy%20OR%20scikit-learn%20OR%20smart_open%20OR%20sqlalchemy%20OR%20sqlalchemy_jsonfield%20OR%20sqlalchemy-utils%20OR%20toml%20OR%20tqdm%20OR%20ujson%20OR%20underscore%20OR%20urllib3%20OR%20websocket-client%20OR%20xlrd%20OR%20xmltodict%20OR%20zipp%29&can=1) were found by OSS-Fuzz in Python projects via Atheris. (Access to some bugs may be restricted.)