{"id":"CVE-2022-39209","aliases":["DEBIAN-CVE-2022-39209","EUVD-2022-41748","GHSA-cgh3-p57x-9q7q","RSEC-2023-7","UBUNTU-CVE-2022-39209","USN-7319-1"],"status":"published","title":"Uncontrolled Resource Consumption in cmark-gfm","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print(\"![l\"* 100000 + \"\\n\")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02295,"percentile":0.83406,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-407"],"published":"2022-09-15T00:00:00Z","modified":"2026-11-03T08:04:10Z","fixes":[{"ecosystem":"Debian:12","package":"cmark-gfm","fixed_in":["0.29.0.gfm.6-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cmark-gfm","fixed_in":["0.29.0.gfm.6-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cmark-gfm","fixed_in":["0.29.0.gfm.6-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ghostwriter","fixed_in":["2.1.6+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ghostwriter","fixed_in":["2.1.6+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ghostwriter","fixed_in":["2.1.6+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-cmarkgfm","fixed_in":["2024.11.20-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-cmarkgfm","fixed_in":["2024.11.20-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"r-cran-commonmark","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"r-cran-commonmark","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"r-cran-commonmark","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-commonmarker","fixed_in":["0.23.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-commonmarker","fixed_in":["0.23.10-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cmark-gfm","fixed_in":["0.29.0.gfm.0-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cmark-gfm","fixed_in":["0.29.0.gfm.3-3ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.6-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.6-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.6-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ghostwriter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.6+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ghostwriter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.6+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ghostwriter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.6+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-3","2024.11.20-1","2025.10.22-1","2025.10.22-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.11.20-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.11.20-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.10-1","0.23.6-1","0.23.9-1","2.10.0-1","2.10.0-2","2.10.1-1","2.8.3-1","2.8.3-2","2.8.3-3","2.8.3-4"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.10-1"}]}]},{"source":"osv","ecosystem":"CRAN","package":"commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2"},{"fixed":"1.8"}]}],"versions":["0.2","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.2","1.4","1.5","1.6","1.7"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.0-4ubuntu0.1~esm1"}]}],"versions":["0.28.3.gfm.20-3","0.29.0.gfm.0-3","0.29.0.gfm.0-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.3-3ubuntu0.1~esm1"}]}],"versions":["0.29.0.gfm.0-6","0.29.0.gfm.2-1","0.29.0.gfm.2-1+really.0.29.0.gfm.0ubuntu1","0.29.0.gfm.2-2","0.29.0.gfm.3-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.0-4ubuntu0.1~esm1"}]}],"versions":["0.28.3.gfm.20-3","0.29.0.gfm.0-3","0.29.0.gfm.0-4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.3-3ubuntu0.1~esm1"}]}],"versions":["0.29.0.gfm.0-6","0.29.0.gfm.2-1","0.29.0.gfm.2-1+really.0.29.0.gfm.0ubuntu1","0.29.0.gfm.2-2","0.29.0.gfm.3-3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.6-6ubuntu0.24.04.1~esm1"}]}],"versions":["0.29.0.gfm.6-6","0.29.0.gfm.6-6build1"],"bundled":5}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"github","product":"cmark-gfm"}],"references":[{"url":"https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/github/cmark-gfm/commit/9d57d8a23142b316282bdfc954cb0ecda40a8655","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://en.wikipedia.org/wiki/Time_complexity","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMGP65NANDVKPDMXMKYO2ZV2H2HZJY4P/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUCZN3PEKUCT2JQYQTYOVIJG2KSD6G7/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEAAAI4OULDYQ2TA3HOXH54PC3DCBFZS/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39209.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39209","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-39209","tags":["advisory","web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24724","tags":["web"]},{"url":"https://github.com/r-lib/commonmark/pull/18","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-39209","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39209","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7319-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-22483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-22484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-22486","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-26485","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-39209","title":"Uncontrolled Resource Consumption in cmark-gfm","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print(\"![l\"* 100000 + \"\\n\")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.","status":"published","published":"2022-09-15T00:00:00Z","modified":"2025-04-23T17:10:11.051Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:39.559326Z"}],"euvd":[{"id":"EUVD-2022-41748","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print(\"![l\"* 100000 + \"\\n\")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.","status":"published","published":"2022-09-15T00:00:00Z","modified":"2025-04-23T17:10:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:10.906327Z"}],"nvd":[{"id":"CVE-2022-39209","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print(\"![l\"* 100000 + \"\\n\")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.","status":"published","published":"2022-09-15T18:15:12.26Z","modified":"2026-06-17T04:57:55.187Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:07:28.118799Z"}],"osv":[{"id":"CVE-2022-39209","title":"Uncontrolled Resource Consumption in cmark-gfm","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print(\"![l\"* 100000 + \"\\n\")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.","status":"published","published":"2022-09-15T00:00:00Z","modified":"2026-10-28T02:30:43.798406964Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"DEBIAN-CVE-2022-39209","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print(\"![l\"* 100000 + \"\\n\")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.","status":"published","published":"2022-09-15T18:15:12.26Z","modified":"2026-11-03T08:04:10.291781695Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"UBUNTU-CVE-2022-39209","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print(\"![l\"* 100000 + \"\\n\")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.","status":"published","published":"2022-09-15T18:15:00Z","modified":"2026-04-22T13:26:52.469732Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"RSEC-2023-7","title":"Denial of Service (DoS) and Arbitrary Code Execution (ACE) vulnerabilities","description":"cmark-gfm, GitHub's extended CommonMark library, has multiple vulnerabilities. Versions prior to 0.29.0.gfm.6 suffer from a polynomial time complexity issue in the autolink extension, causing denial of service. Also, versions before 0.29.0.gfm.3 and 0.28.3.gfm.21 contain an integer overflow in table row parsing, leading to heap corruption and potential Arbitrary Code Execution. Patches are available in versions 0.29.0.gfm.6, 0.29.0.gfm.3, and 0.28.3.gfm.21. Mitigations include upgrading or disabling affected extensions.","status":"published","published":"2023-10-06T05:00:00.6Z","modified":"2025-05-19T19:43:48.143066Z","updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"USN-7319-1","title":"cmark-gfm vulnerabilities","description":"It was discovered that cmark-gfm's autolink extension did not correctly\nhandle parsing large inputs. An attacker could possibly use this issue\nto cause a denial of service. This issue only affected Ubuntu 20.04 LTS\nand Ubuntu 22.04 LTS. (CVE-2022-39209)\n\nIt was discovered that cmark-gfm did not correctly handle parsing large\ninputs. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\nUbuntu 24.10. (CVE-2023-22483)\n\nIt was discovered that cmark-gfm did not correctly handle parsing large\ninputs. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10.\n(CVE-2023-22484)\n\nIt was discovered that cmark-gfm did not correctly handle parsing large\ninputs. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2023-22486, CVE-2023-26485)\n","status":"published","published":"2025-03-03T23:22:29Z","modified":"2026-04-27T17:47:00.261453Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}