{"id":"CVE-2023-22484","aliases":["DEBIAN-CVE-2023-22484","EUVD-2023-26631","GHSA-24f7-9frr-5h2r","MGASA-2023-0181","RSEC-2023-8","UBUNTU-CVE-2023-22484","USN-7319-1","openSUSE-SU-2024:12802-1"],"status":"published","title":"Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of service","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00966,"percentile":0.62156,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-407"],"published":"2023-01-23T22:42:57Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"Debian:13","package":"cmark-gfm","fixed_in":["0.29.0.gfm.13-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cmark-gfm","fixed_in":["0.29.0.gfm.13-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-cmarkgfm","fixed_in":["2024.11.20-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-cmarkgfm","fixed_in":["2024.11.20-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"r-cran-commonmark","fixed_in":["1.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"r-cran-commonmark","fixed_in":["1.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-commonmarker","fixed_in":["0.23.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-commonmarker","fixed_in":["0.23.10-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cmark-gfm","fixed_in":["0.29.0.gfm.6-6ubuntu0.24.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.29.0.gfm.13-1","0.29.0.gfm.13-2","0.29.0.gfm.13-3","0.29.0.gfm.13-4","0.29.0.gfm.13-7","0.29.0.gfm.13-7.1","0.29.0.gfm.6-6"]},{"source":"osv","ecosystem":"Debian:13","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.13-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.13-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-3","2024.11.20-1","2025.10.22-1","2025.10.22-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.11.20-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.11.20-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-1","1.9.0-1","1.9.1-1","1.9.2-1","1.9.2-2","1.9.5-1","2.0.0-1","2.0.0-2","2.0.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.10-1","0.23.6-1","0.23.9-1","2.10.0-1","2.10.0-2","2.10.1-1","2.8.3-1","2.8.3-2","2.8.3-3","2.8.3-4"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.10-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.3-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"CRAN","package":"commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2"},{"fixed":"1.9.2"}]}],"versions":["0.2","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.2","1.4","1.5","1.6","1.7","1.8","1.9","1.9.1","1.8.0","1.8.1","1.9.0"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28.3.gfm.20-3","0.29.0.gfm.0-3","0.29.0.gfm.0-4","0.29.0.gfm.0-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.29.0.gfm.0-6","0.29.0.gfm.2-1","0.29.0.gfm.2-1+really.0.29.0.gfm.0ubuntu1","0.29.0.gfm.2-2","0.29.0.gfm.3-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.6-6ubuntu0.24.04.1~esm1"}]}],"versions":["0.29.0.gfm.6-6","0.29.0.gfm.6-6build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.0-4ubuntu0.1~esm1"}]}],"versions":["0.28.3.gfm.20-3","0.29.0.gfm.0-3","0.29.0.gfm.0-4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.3-3ubuntu0.1~esm1"}]}],"versions":["0.29.0.gfm.0-6","0.29.0.gfm.2-1","0.29.0.gfm.2-1+really.0.29.0.gfm.0ubuntu1","0.29.0.gfm.2-2","0.29.0.gfm.3-3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.6-6ubuntu0.24.04.1~esm1"}]}],"versions":["0.29.0.gfm.6-6","0.29.0.gfm.6-6build1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.3-1.1"}]}],"bundled":2}],"products":[{"vendor":"github","product":"cmark-gfm"}],"references":[{"url":"https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22484.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22484","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22484","tags":["advisory","web"]},{"url":"https://advisories.mageia.org/MGASA-2023-0181.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31885","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-May/014722.html","tags":["web"]},{"url":"https://github.com/commonmark/cmark/releases/tag/0.30.3","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-37463","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-26485","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-24824","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22486","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22485","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22483","tags":["web"]},{"url":"https://github.com/r-lib/commonmark/issues/26","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-22484","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22484","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7319-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-39209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-22483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-22486","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-26485","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22486","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-22484","title":"Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of service","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-23T22:42:57.79Z","modified":"2025-03-10T21:20:57.334Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:35:15.779187Z"}],"euvd":[{"id":"EUVD-2023-26631","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-23T22:42:57Z","modified":"2025-03-10T21:20:57Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:53:08.584552Z"}],"nvd":[{"id":"CVE-2023-22484","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-23T23:15:10.423Z","modified":"2026-06-17T05:35:33.633Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"CVE-2023-22484","title":"Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of service","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-23T22:42:57.79Z","modified":"2026-10-28T02:30:54.863112628Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"DEBIAN-CVE-2023-22484","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-23T23:15:10.423Z","modified":"2026-10-26T18:01:21.226924318Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"UBUNTU-CVE-2023-22484","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-23T23:15:00Z","modified":"2026-04-22T14:01:47.893367Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"MGASA-2023-0181","title":"Updated cmark packages fix security vulnerability","description":"cmark incorrectly handled certain inputs. Fixes quadratic complexity in\nhandle_close_bracket \"![[]()\" which may lead to a denial of service\n(CVE-2023-22486).\nNoting that this also fixes a quadratic parsing issue with repeated comment\ntags that was not in a released product but which was assigned a CVE\n(CVE-2023-22484).\n","status":"published","published":"2023-05-21T08:42:44Z","modified":"2026-04-16T04:43:57.825326411Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12802-1","title":"cmark-0.30.3-1.1 on GA media","description":"These are all security issues fixed in the cmark-0.30.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:59:31.589495Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"RSEC-2023-8","title":"Denial of Service (DoS) vulnerabilities","description":"cmark-gfm, GitHub's extended version of the CommonMark library in C, suffers from multiple vulnerabilities affecting versions prior to 0.29.0.gfm.12. Various issues, including polynomial time complexity in multiple components like autolink extension, handle_close_bracket, and parsing of certain text patterns (leading `\u003e`, `-`, `_`), may lead to unbounded resource exhaustion and denial of service. An out-of-bounds read in the `validate_protocol` function was also identified but is considered less harmful. Patches are available in versions 0.29.0.gfm.7, 0.29.0.gfm.10, and 0.29.0.gfm.12. Upgrading is advised, and users unable to upgrade should validate input from trusted sources.","status":"published","published":"2023-10-06T05:00:00.6Z","modified":"2025-05-19T19:43:48.265479Z","updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"USN-7319-1","title":"cmark-gfm vulnerabilities","description":"It was discovered that cmark-gfm's autolink extension did not correctly\nhandle parsing large inputs. An attacker could possibly use this issue\nto cause a denial of service. This issue only affected Ubuntu 20.04 LTS\nand Ubuntu 22.04 LTS. (CVE-2022-39209)\n\nIt was discovered that cmark-gfm did not correctly handle parsing large\ninputs. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\nUbuntu 24.10. (CVE-2023-22483)\n\nIt was discovered that cmark-gfm did not correctly handle parsing large\ninputs. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10.\n(CVE-2023-22484)\n\nIt was discovered that cmark-gfm did not correctly handle parsing large\ninputs. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2023-22486, CVE-2023-26485)\n","status":"published","published":"2025-03-03T23:22:29Z","modified":"2026-04-27T17:47:00.261453Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}