{"id":"CVE-2023-22486","aliases":["ALPINE-CVE-2023-22486","DEBIAN-CVE-2023-22486","EUVD-2023-26633","GHSA-r572-jvj2-3m8p","MGASA-2023-0181","RSEC-2023-8","SUSE-SU-2023:1834-1","UBUNTU-CVE-2023-22486","USN-7319-1","openSUSE-SU-2024:12802-1"],"status":"published","title":"cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of service","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a  polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01119,"percentile":0.66418,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-407"],"published":"2023-01-24T02:30:29Z","modified":"2026-11-03T06:32:58Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"cmark","fixed_in":["0.30.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"cmark","fixed_in":["0.30.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cmark","fixed_in":["0.30.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cmark","fixed_in":["0.30.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cmark","fixed_in":["0.30.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cmark","fixed_in":["0.30.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cmark","fixed_in":["0.30.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cmark","fixed_in":["0.30.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cmark-gfm","fixed_in":["0.29.0.gfm.13-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cmark-gfm","fixed_in":["0.29.0.gfm.13-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-cmarkgfm","fixed_in":["2024.11.20-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-cmarkgfm","fixed_in":["2024.11.20-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"r-cran-commonmark","fixed_in":["1.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"r-cran-commonmark","fixed_in":["1.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-commonmarker","fixed_in":["0.23.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-commonmarker","fixed_in":["0.23.10-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"cmark","fixed_in":["0.30.2-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"cmark","fixed_in":["0.30.2-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"cmark","fixed_in":["0.30.2-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cmark-gfm","fixed_in":["0.29.0.gfm.0-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cmark-gfm","fixed_in":["0.29.0.gfm.3-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cmark-gfm","fixed_in":["0.29.0.gfm.6-6ubuntu0.24.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.29.0.gfm.13-1","0.29.0.gfm.13-2","0.29.0.gfm.13-3","0.29.0.gfm.13-4","0.29.0.gfm.13-7","0.29.0.gfm.13-7.1","0.29.0.gfm.6-6"]},{"source":"osv","ecosystem":"Debian:13","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.13-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.13-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-3","2024.11.20-1","2025.10.22-1","2025.10.22-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.11.20-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.11.20-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-1","1.9.0-1","1.9.1-1","1.9.2-1","1.9.2-2","1.9.5-1","2.0.0-1","2.0.0-2","2.0.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.10-1","0.23.6-1","0.23.9-1","2.10.0-1","2.10.0-2","2.10.1-1","2.8.3-1","2.8.3-2","2.8.3-3","2.8.3-4"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.10-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.3-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"CRAN","package":"commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2"},{"fixed":"1.9.2"}]}],"versions":["0.2","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.2","1.4","1.5","1.6","1.7","1.8","1.9","1.9.1","1.8.0","1.8.1","1.9.0"],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.2-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.2-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.2-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28.3-1","0.29.0-1ubuntu2","0.29.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.0-4ubuntu0.1~esm1"}]}],"versions":["0.28.3.gfm.20-3","0.29.0.gfm.0-3","0.29.0.gfm.0-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.29.0-4","0.30.2-3","0.30.2-4","0.30.2-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.3-3ubuntu0.1~esm1"}]}],"versions":["0.29.0.gfm.0-6","0.29.0.gfm.2-1","0.29.0.gfm.2-1+really.0.29.0.gfm.0ubuntu1","0.29.0.gfm.2-2","0.29.0.gfm.3-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.2-6","0.30.2-6build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.6-6ubuntu0.24.04.1~esm1"}]}],"versions":["0.29.0.gfm.6-6","0.29.0.gfm.6-6build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.2-6build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.2-6build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.2-6build1","0.30.2-6build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.0-4ubuntu0.1~esm1"}]}],"versions":["0.28.3.gfm.20-3","0.29.0.gfm.0-3","0.29.0.gfm.0-4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.3-3ubuntu0.1~esm1"}]}],"versions":["0.29.0.gfm.0-6","0.29.0.gfm.2-1","0.29.0.gfm.2-1+really.0.29.0.gfm.0ubuntu1","0.29.0.gfm.2-2","0.29.0.gfm.3-3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.6-6ubuntu0.24.04.1~esm1"}]}],"versions":["0.29.0.gfm.6-6","0.29.0.gfm.6-6build1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.3-1.1"}]}],"bundled":2}],"products":[{"vendor":"github","product":"cmark-gfm"}],"references":[{"url":"https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-22486","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22486.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22486","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22486","tags":["advisory","web"]},{"url":"https://advisories.mageia.org/MGASA-2023-0181.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31885","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-May/014722.html","tags":["web"]},{"url":"https://github.com/commonmark/cmark/releases/tag/0.30.3","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-37463","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-26485","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-24824","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22485","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22484","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22483","tags":["web"]},{"url":"https://github.com/r-lib/commonmark/issues/26","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231834-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207674","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22486","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-22486","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22486","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7319-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-39209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-22483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-22484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-26485","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22484","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-22486","title":"cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of service","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a  polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-24T02:30:29.099Z","modified":"2025-03-10T21:20:44.634Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:35:15.779187Z"}],"euvd":[{"id":"EUVD-2023-26633","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a  polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-24T02:30:29Z","modified":"2025-03-10T21:20:44Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:53:08.584552Z"}],"nvd":[{"id":"CVE-2023-22486","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a  polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-26T21:18:12.363Z","modified":"2026-06-17T05:35:33.907Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"ALPINE-CVE-2023-22486","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a  polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-26T21:18:12.363Z","modified":"2026-11-03T06:32:58.906315305Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2023-22486","title":"cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of service","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a  polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-24T02:30:29.099Z","modified":"2026-10-28T02:31:07.715553117Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"DEBIAN-CVE-2023-22486","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a  polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-26T21:18:12.363Z","modified":"2026-10-26T18:01:08.758844149Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"UBUNTU-CVE-2023-22486","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.","status":"published","published":"2023-01-26T21:18:00Z","modified":"2026-10-17T12:56:03.775139294Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"MGASA-2023-0181","title":"Updated cmark packages fix security vulnerability","description":"cmark incorrectly handled certain inputs. Fixes quadratic complexity in\nhandle_close_bracket \"![[]()\" which may lead to a denial of service\n(CVE-2023-22486).\nNoting that this also fixes a quadratic parsing issue with repeated comment\ntags that was not in a released product but which was assigned a CVE\n(CVE-2023-22484).\n","status":"published","published":"2023-05-21T08:42:44Z","modified":"2026-04-16T04:43:57.825326411Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12802-1","title":"cmark-0.30.3-1.1 on GA media","description":"These are all security issues fixed in the cmark-0.30.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:59:31.589495Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"RSEC-2023-8","title":"Denial of Service (DoS) vulnerabilities","description":"cmark-gfm, GitHub's extended version of the CommonMark library in C, suffers from multiple vulnerabilities affecting versions prior to 0.29.0.gfm.12. Various issues, including polynomial time complexity in multiple components like autolink extension, handle_close_bracket, and parsing of certain text patterns (leading `\u003e`, `-`, `_`), may lead to unbounded resource exhaustion and denial of service. An out-of-bounds read in the `validate_protocol` function was also identified but is considered less harmful. Patches are available in versions 0.29.0.gfm.7, 0.29.0.gfm.10, and 0.29.0.gfm.12. Upgrading is advised, and users unable to upgrade should validate input from trusted sources.","status":"published","published":"2023-10-06T05:00:00.6Z","modified":"2025-05-19T19:43:48.265479Z","updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"SUSE-SU-2023:1834-1","title":"Security update for cmark","description":"This update for cmark fixes the following issues:\n\n- CVE-2023-22486: Fixed quadratic complexity in handle_close_bracket may lead to a denial of service (bsc#1207674).\n","status":"published","published":"2023-04-13T12:01:29Z","modified":"2026-02-04T04:18:41.308294Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"USN-7319-1","title":"cmark-gfm vulnerabilities","description":"It was discovered that cmark-gfm's autolink extension did not correctly\nhandle parsing large inputs. An attacker could possibly use this issue\nto cause a denial of service. This issue only affected Ubuntu 20.04 LTS\nand Ubuntu 22.04 LTS. (CVE-2022-39209)\n\nIt was discovered that cmark-gfm did not correctly handle parsing large\ninputs. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\nUbuntu 24.10. (CVE-2023-22483)\n\nIt was discovered that cmark-gfm did not correctly handle parsing large\ninputs. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10.\n(CVE-2023-22484)\n\nIt was discovered that cmark-gfm did not correctly handle parsing large\ninputs. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2023-22486, CVE-2023-26485)\n","status":"published","published":"2025-03-03T23:22:29Z","modified":"2026-04-27T17:47:00.261453Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}