CVE-2023-37463
Quadratic complexity bugs may lead to a denial of service
cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Quadratic complexity bugs may lead to a denial of service
cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.
- Record
CVE-2023-37463- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2023-41361
cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.
- Record
EUVD-2023-41361- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-03
NVD
cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.
- Record
CVE-2023-37463- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Quadratic complexity bugs may lead to a denial of service
cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.
- Record
CVE-2023-37463- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-37463
cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.
- Record
DEBIAN-CVE-2023-37463- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13136-1 No score
python310-cmarkgfm-2022.10.27-3.1 on GA media
These are all security issues fixed in the python310-cmarkgfm-2022.10.27-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13136-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12003-1 No score
python313-cmarkgfm-2025.10.22-1.4 on GA media
These are all security issues fixed in the python313-cmarkgfm-2025.10.22-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12003-1- Updated
- 2026-11-02
OSVRSEC-2023-8 No score
Denial of Service (DoS) vulnerabilities
cmark-gfm, GitHub's extended version of the CommonMark library in C, suffers from multiple vulnerabilities affecting versions prior to 0.29.0.gfm.12. Various issues, including polynomial time complexity in multiple components like autolink extension, handle_close_bracket, and parsing of certain text patterns (leading >, -, _), may lead to unbounded resource exhaustion and denial of service. An out-of-bounds read in the validate_protocol function was also identified but is considered less harmful. Patches are available in versions 0.29.0.gfm.7, 0.29.0.gfm.10, and 0.29.0.gfm.12. Upgrading is advised, and users unable to upgrade should validate input from trusted sources.
- Record
RSEC-2023-8- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cmark-gfmDebian:12 |
All versions, plus listed versions 0.29.0.gfm.13-10.29.0.gfm.13-20.29.0.gfm.13-30.29.0.gfm.13-40.29.0.gfm.13-70.29.0.gfm.13-7.10.29.0.gfm.6-6 |
None known |
cmark-gfmDebian:13 |
before 0.29.0.gfm.13-1 | 0.29.0.gfm.13-1 |
cmark-gfmDebian:14 |
before 0.29.0.gfm.13-1 | 0.29.0.gfm.13-1 |
python-cmarkgfmDebian:12 |
All versions, plus listed versions 0.8.0-32024.11.20-12025.10.22-12025.10.22-2 |
None known |
python-cmarkgfmDebian:13 |
before 2024.11.20-1 | 2024.11.20-1 |
python-cmarkgfmDebian:14 |
before 2024.11.20-1 | 2024.11.20-1 |
r-cran-commonmarkDebian:12 |
All versions, plus listed versions 1.8.1-11.9.0-11.9.1-11.9.2-11.9.2-2 Show 4 moreShow less1.9.5-12.0.0-12.0.0-22.0.0-3 |
None known |
r-cran-commonmarkDebian:13 |
before 1.9.1-1 | 1.9.1-1 |
r-cran-commonmarkDebian:14 |
before 1.9.1-1 | 1.9.1-1 |
ruby-commonmarkerDebian:12 |
All versions, plus listed versions 0.23.10-10.23.6-10.23.9-12.10.0-12.10.0-2 Show 5 moreShow less2.10.1-12.8.3-12.8.3-22.8.3-32.8.3-4 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ruby-commonmarkerDebian:13 |
before 0.23.10-1 | 0.23.10-1 |
ruby-commonmarkerDebian:14 |
before 0.23.10-1 | 0.23.10-1 |
commonmarkCRAN From an advisory covering 7 CVEs |
0.2 up to 1.9.2, plus listed versions 0.40.50.60.70.8 Show 14 moreShow less0.91.01.11.21.41.51.61.71.81.91.9.11.8.01.8.11.9.0 |
1.9.2 |
python-cmarkgfmopenSUSE:Tumbleweed |
before 2025.10.22-1.4 | 2025.10.22-1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-37463 is a medium vulnerability (CVSS 6.4) in Github Cmark-gfm, published July 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in cmark-gfm 0.29.0.gfm.13-1.
References
github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5
nvd.nist.gov/vuln/detail/CVE-2023-37463
security-tracker.debian.org/tracker/CVE-2023-37463
Show 7 moreShow less
suse.com/security/cve/CVE-2023-37463