{"id":"CVE-2023-22485","aliases":["DEBIAN-CVE-2023-22485","EUVD-2023-26632","GHSA-c944-cv5f-hpvr","RSEC-2023-8","UBUNTU-CVE-2023-22485"],"status":"published","title":"cmark-gfm out-of-bounds read in validate_protocol","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0073,"percentile":0.54607,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-91"],"published":"2023-01-24T00:26:57Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"Debian:13","package":"cmark-gfm","fixed_in":["0.29.0.gfm.13-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cmark-gfm","fixed_in":["0.29.0.gfm.13-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-cmarkgfm","fixed_in":["2024.11.20-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-cmarkgfm","fixed_in":["2024.11.20-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"r-cran-commonmark","fixed_in":["1.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"r-cran-commonmark","fixed_in":["1.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-commonmarker","fixed_in":["0.23.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-commonmarker","fixed_in":["0.23.10-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.29.0.gfm.13-1","0.29.0.gfm.13-2","0.29.0.gfm.13-3","0.29.0.gfm.13-4","0.29.0.gfm.13-7","0.29.0.gfm.13-7.1","0.29.0.gfm.6-6"]},{"source":"osv","ecosystem":"Debian:13","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.13-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.13-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-3","2024.11.20-1","2025.10.22-1","2025.10.22-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.11.20-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.11.20-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-1","1.9.0-1","1.9.1-1","1.9.2-1","1.9.2-2","1.9.5-1","2.0.0-1","2.0.0-2","2.0.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.10-1","0.23.6-1","0.23.9-1","2.10.0-1","2.10.0-2","2.10.1-1","2.8.3-1","2.8.3-2","2.8.3-3","2.8.3-4"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.10-1"}]}]},{"source":"osv","ecosystem":"CRAN","package":"commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2"},{"fixed":"1.9.2"}]}],"versions":["0.2","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.2","1.4","1.5","1.6","1.7","1.8","1.9","1.9.1","1.8.0","1.8.1","1.9.0"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28.3.gfm.20-3","0.29.0.gfm.0-3","0.29.0.gfm.0-4","0.29.0.gfm.0-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.29.0.gfm.0-6","0.29.0.gfm.2-1","0.29.0.gfm.2-1+really.0.29.0.gfm.0ubuntu1","0.29.0.gfm.2-2","0.29.0.gfm.3-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.29.0.gfm.6-6","0.29.0.gfm.6-6build1"]}],"products":[{"vendor":"github","product":"cmark-gfm"}],"references":[{"url":"https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22485.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22485","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22485","tags":["advisory","web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-37463","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-26485","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-24824","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22486","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22484","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22483","tags":["web"]},{"url":"https://github.com/r-lib/commonmark/issues/26","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-22485","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22485","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-22485","title":"cmark-gfm out-of-bounds read in validate_protocol","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-24T00:26:57.671Z","modified":"2025-03-10T21:20:51.304Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:16.126506Z"}],"euvd":[{"id":"EUVD-2023-26632","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-24T00:26:57Z","modified":"2025-03-10T21:20:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:08.584552Z"}],"nvd":[{"id":"CVE-2023-22485","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-24T01:15:10.593Z","modified":"2026-06-17T05:35:33.767Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-125","CWE-91"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"CVE-2023-22485","title":"cmark-gfm out-of-bounds read in validate_protocol","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-24T00:26:57.671Z","modified":"2026-10-28T02:30:55.427089805Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"DEBIAN-CVE-2023-22485","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-24T01:15:10.593Z","modified":"2026-10-26T18:01:09.010435364Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"UBUNTU-CVE-2023-22485","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-24T01:15:00Z","modified":"2026-04-22T14:01:57.311308Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"RSEC-2023-8","title":"Denial of Service (DoS) vulnerabilities","description":"cmark-gfm, GitHub's extended version of the CommonMark library in C, suffers from multiple vulnerabilities affecting versions prior to 0.29.0.gfm.12. Various issues, including polynomial time complexity in multiple components like autolink extension, handle_close_bracket, and parsing of certain text patterns (leading `\u003e`, `-`, `_`), may lead to unbounded resource exhaustion and denial of service. An out-of-bounds read in the `validate_protocol` function was also identified but is considered less harmful. Patches are available in versions 0.29.0.gfm.7, 0.29.0.gfm.10, and 0.29.0.gfm.12. Upgrading is advised, and users unable to upgrade should validate input from trusted sources.","status":"published","published":"2023-10-06T05:00:00.6Z","modified":"2025-05-19T19:43:48.265479Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}