Every CVE Search/ Get API key

CVE-2023-22484

Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of service

3.5 LowFix available

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.97%Up 0.1 points since Jan 24, 2023
90%50%10%1%

What each source reports

CVE List Score used 3.5

Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of service

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

Record
CVE-2023-22484
CVSS 3.1
3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400, CWE-407
Updated
2026-11-02
EUVDEUVD-2023-26631 3.5

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

Record
EUVD-2023-26631
CVSS 3.1
3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
NVD 3.5

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

Record
CVE-2023-22484
CVSS 3.1
3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-407
Updated
2026-11-02
OSV 3.5

Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of service

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

Record
CVE-2023-22484
CVSS 3.1
3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400, CWE-407
Updated
2026-11-02
OSVDEBIAN-CVE-2023-22484 7.5

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

Record
DEBIAN-CVE-2023-22484
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-22484 3.5

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

Record
UBUNTU-CVE-2023-22484
CVSS 3.1
3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVMGASA-2023-0181 No score

Updated cmark packages fix security vulnerability

cmark incorrectly handled certain inputs. Fixes quadratic complexity in handle_close_bracket "![" which may lead to a denial of service (CVE-2023-22486). Noting that this also fixes a quadratic parsing issue with repeated comment tags that was not in a released product but which was assigned a CVE (CVE-2023-22484).

Record
MGASA-2023-0181
Updated
2026-11-02
OSVopenSUSE-SU-2024:12802-1 No score

cmark-0.30.3-1.1 on GA media

These are all security issues fixed in the cmark-0.30.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12802-1
Updated
2026-11-02
OSVRSEC-2023-8 No score

Denial of Service (DoS) vulnerabilities

cmark-gfm, GitHub's extended version of the CommonMark library in C, suffers from multiple vulnerabilities affecting versions prior to 0.29.0.gfm.12. Various issues, including polynomial time complexity in multiple components like autolink extension, handle_close_bracket, and parsing of certain text patterns (leading >, -, _), may lead to unbounded resource exhaustion and denial of service. An out-of-bounds read in the validate_protocol function was also identified but is considered less harmful. Patches are available in versions 0.29.0.gfm.7, 0.29.0.gfm.10, and 0.29.0.gfm.12. Upgrading is advised, and users unable to upgrade should validate input from trusted sources.

Record
RSEC-2023-8
Updated
2026-11-02
OSVUSN-7319-1 No score

cmark-gfm vulnerabilities

It was discovered that cmark-gfm's autolink extension did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-39209)

It was discovered that cmark-gfm did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2023-22483)

It was discovered that cmark-gfm did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2023-22484)

It was discovered that cmark-gfm did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-22486, CVE-2023-26485)

Record
USN-7319-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cmark-gfm
Debian:12
 All versions, plus listed versions
0.29.0.gfm.13-10.29.0.gfm.13-20.29.0.gfm.13-30.29.0.gfm.13-40.29.0.gfm.13-70.29.0.gfm.13-7.10.29.0.gfm.6-6
 None known
cmark-gfm
Debian:13
 before 0.29.0.gfm.13-1
0.29.0.gfm.13-1
cmark-gfm
Debian:14
 before 0.29.0.gfm.13-1
0.29.0.gfm.13-1
python-cmarkgfm
Debian:12
 All versions, plus listed versions
0.8.0-32024.11.20-12025.10.22-12025.10.22-2
 None known
python-cmarkgfm
Debian:13
 before 2024.11.20-1
2024.11.20-1
python-cmarkgfm
Debian:14
 before 2024.11.20-1
2024.11.20-1
r-cran-commonmark
Debian:12
 All versions, plus listed versions
1.8.1-11.9.0-11.9.1-11.9.2-11.9.2-2
Show 4 moreShow less
1.9.5-12.0.0-12.0.0-22.0.0-3
 None known
r-cran-commonmark
Debian:13
 before 1.9.0-1
1.9.0-1
r-cran-commonmark
Debian:14
 before 1.9.0-1
1.9.0-1
ruby-commonmarker
Debian:12
 All versions, plus listed versions
0.23.10-10.23.6-10.23.9-12.10.0-12.10.0-2
Show 5 moreShow less
2.10.1-12.8.3-12.8.3-22.8.3-32.8.3-4
 None known
Show 11 moreShow less
Affected packages
PackageAffectedFixed
ruby-commonmarker
Debian:13
 before 0.23.10-1
0.23.10-1
ruby-commonmarker
Debian:14
 before 0.23.10-1
0.23.10-1
cmark
Mageia:8
From an advisory covering 2 CVEs
 before 0.30.3-1.mga8
0.30.3-1.mga8
commonmark
CRAN
From an advisory covering 7 CVEs
 0.2 up to 1.9.2, plus listed versions
0.40.50.60.70.8
Show 14 moreShow less
0.91.01.11.21.41.51.61.71.81.91.9.11.8.01.8.11.9.0
1.9.2
cmark-gfm
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
0.28.3.gfm.20-30.29.0.gfm.0-30.29.0.gfm.0-40.29.0.gfm.0-4ubuntu0.1~esm1
 None known
cmark-gfm
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.29.0.gfm.0-60.29.0.gfm.2-10.29.0.gfm.2-1+really.0.29.0.gfm.0ubuntu10.29.0.gfm.2-20.29.0.gfm.3-3
 None known
cmark-gfm
Ubuntu:Pro:24.04:LTS
 before 0.29.0.gfm.6-6ubuntu0.24.04.1~esm1, plus listed versions
0.29.0.gfm.6-60.29.0.gfm.6-6build1
0.29.0.gfm.6-6ubuntu0.24.04.1~esm1
cmark-gfm
Ubuntu:Pro:20.04:LTS
From an advisory covering 5 CVEs
 before 0.29.0.gfm.0-4ubuntu0.1~esm1, plus listed versions
0.28.3.gfm.20-30.29.0.gfm.0-30.29.0.gfm.0-4
0.29.0.gfm.0-4ubuntu0.1~esm1
cmark-gfm
Ubuntu:Pro:22.04:LTS
From an advisory covering 5 CVEs
 before 0.29.0.gfm.3-3ubuntu0.1~esm1, plus listed versions
0.29.0.gfm.0-60.29.0.gfm.2-10.29.0.gfm.2-1+really.0.29.0.gfm.0ubuntu10.29.0.gfm.2-20.29.0.gfm.3-3
0.29.0.gfm.3-3ubuntu0.1~esm1
cmark-gfm
Ubuntu:Pro:24.04:LTS
From an advisory covering 5 CVEs
 before 0.29.0.gfm.6-6ubuntu0.24.04.1~esm1, plus listed versions
0.29.0.gfm.6-60.29.0.gfm.6-6build1
0.29.0.gfm.6-6ubuntu0.24.04.1~esm1
cmark
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 0.30.3-1.1
0.30.3-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-22484 is a low vulnerability (CVSS 3.5) in Github Cmark-gfm, published January 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 61st percentile. Fixed in cmark-gfm 0.29.0.gfm.13-1.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open