GHSA-xxmq-4vph-956w
Comrak vulnerable to production of excessive output when parsing Markdown (GHSL-2023-048)
Impact
comrak is vulnerable to the upstream cmark issue, "Issue revealed by fuzzer". A large number of references in a markdown document can trigger an overly large response.
Patches
0.17.0 contains https://github.com/kivikakk/comrak/commit/70f97f3ea4eae30ffbd1b94c764a3de2f1c41d2a, which limits reference output to a 100Kb maximum.
Workarounds
n/a
References
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
GitHub Advisories Score used
Comrak vulnerable to production of excessive output when parsing Markdown (GHSL-2023-048)
Impact
comrak is vulnerable to the upstream cmark issue, "Issue revealed by fuzzer". A large number of references in a markdown document can trigger an overly large response.
Patches
0.17.0 contains https://github.com/kivikakk/comrak/commit/70f97f3ea4eae30ffbd1b94c764a3de2f1c41d2a, which limits reference output to a 100Kb maximum.
Workarounds
n/a
References
- Record
GHSA-xxmq-4vph-956w- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSV
Comrak vulnerable to production of excessive output when parsing Markdown (GHSL-2023-048)
Impact
comrak is vulnerable to the upstream cmark issue, "Issue revealed by fuzzer". A large number of references in a markdown document can trigger an overly large response.
Patches
0.17.0 contains https://github.com/kivikakk/comrak/commit/70f97f3ea4eae30ffbd1b94c764a3de2f1c41d2a, which limits reference output to a 100Kb maximum.
Workarounds
n/a
References
- Record
GHSA-xxmq-4vph-956w- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
comrakcrates.io | before 0.17.0 | 0.17.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-xxmq-4vph-956w is a medium vulnerability (CVSS 5.3) in comrak, published March 28, 2023. No source lists public exploit code. Fixed in comrak 0.17.0.