{"id":"CVE-2023-24824","aliases":["ALSA-2025:8427","DEBIAN-CVE-2023-24824","EUVD-2023-28818","GHSA-66g8-4hjf-77xh","HSEC-2025-0007","RHSA-2025:8427","RLSA-2025:8427","RSEC-2023-8","UBUNTU-CVE-2023-24824"],"status":"published","title":"Quadratic complexity may lead to a denial of service in cmark-gfm","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `\u003e` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01036,"percentile":0.64168,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-407"],"published":"2023-03-31T22:01:18Z","modified":"2026-10-29T11:02:23Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"pandoc","fixed_in":["2.0.6-7.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pandoc-common","fixed_in":["2.0.6-7.el8_10"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cmark-gfm","fixed_in":["0.29.0.gfm.13-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cmark-gfm","fixed_in":["0.29.0.gfm.13-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-cmarkgfm","fixed_in":["2024.11.20-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-cmarkgfm","fixed_in":["2024.11.20-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"r-cran-commonmark","fixed_in":["1.9.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"r-cran-commonmark","fixed_in":["1.9.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-commonmarker","fixed_in":["0.23.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-commonmarker","fixed_in":["0.23.10-1"],"sources":["osv"]},{"ecosystem":"Hackage","package":"cmark-gfm","fixed_in":["0.2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"pandoc","fixed_in":["0:2.0.6-7.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"pandoc-common","fixed_in":["0:2.0.6-7.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pandoc","fixed_in":["0:2.0.6-7.el8_10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"pandoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-7.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pandoc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-7.el8_10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.29.0.gfm.13-1","0.29.0.gfm.13-2","0.29.0.gfm.13-3","0.29.0.gfm.13-4","0.29.0.gfm.13-7","0.29.0.gfm.13-7.1","0.29.0.gfm.6-6"]},{"source":"osv","ecosystem":"Debian:13","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.13-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.0.gfm.13-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-3","2024.11.20-1","2025.10.22-1","2025.10.22-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.11.20-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-cmarkgfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.11.20-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-1","1.9.0-1","1.9.1-1","1.9.2-1","1.9.2-2","1.9.5-1","2.0.0-1","2.0.0-2","2.0.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"r-cran-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.10-1","0.23.6-1","0.23.9-1","2.10.0-1","2.10.0-2","2.10.1-1","2.8.3-1","2.8.3-2","2.8.3-3","2.8.3-4"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-commonmarker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.10-1"}]}]},{"source":"osv","ecosystem":"Hackage","package":"cmark-gfm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.2.6"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"pandoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-7.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"pandoc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-7.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pandoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-7.el8_10"}]}]},{"source":"osv","ecosystem":"CRAN","package":"commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2"},{"fixed":"1.9.2"}]}],"versions":["0.2","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.2","1.4","1.5","1.6","1.7","1.8","1.9","1.9.1","1.8.0","1.8.1","1.9.0"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28.3-1","0.29.0-1ubuntu2","0.29.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.29.0-4","0.30.2-3","0.30.2-4","0.30.2-5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.2-6","0.30.2-6build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.2-6build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.2-6build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.2-6build1","0.30.2-6build2"]}],"products":[{"vendor":"github","product":"cmark-gfm"}],"references":[{"url":"https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8427","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24824","tags":["report"]},{"url":"https://bugzilla.redhat.com/2210172","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-8427.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24824.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24824","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-24824","tags":["advisory","web"]},{"url":"https://github.com/kivikakk/cmark-gfm-hs/commit/1359b8740c6b29dde0ad8f816531112b32eb8cbe","tags":["fix"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2210172","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8427.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24824","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8427","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-37463","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-26485","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22486","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22485","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22484","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22483","tags":["web"]},{"url":"https://github.com/r-lib/commonmark/issues/26","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-24824","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-24824","title":"Quadratic complexity may lead to a denial of service in cmark-gfm","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `\u003e` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.","status":"published","published":"2023-03-31T22:01:18.22Z","modified":"2025-02-11T17:19:40.51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:35:27.430605Z"}],"euvd":[{"id":"EUVD-2023-28818","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `\u003e` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.","status":"published","published":"2023-03-31T22:01:18Z","modified":"2025-02-11T17:19:40Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:03:59.282543Z"}],"nvd":[{"id":"CVE-2023-24824","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `\u003e` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.","status":"published","published":"2023-03-31T23:15:07.153Z","modified":"2026-06-17T05:39:56.317Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:07:51.883939Z"}],"osv":[{"id":"CVE-2023-24824","title":"Quadratic complexity may lead to a denial of service in cmark-gfm","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `\u003e` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.","status":"published","published":"2023-03-31T22:01:18.22Z","modified":"2026-10-28T02:30:38.794384894Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-24824","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `\u003e` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.","status":"published","published":"2023-03-31T23:15:07.153Z","modified":"2026-10-26T18:01:09.508473147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"RHSA-2025:8427","title":"Red Hat Security Advisory: pandoc security update","status":"published","published":"2025-06-03T10:05:13Z","modified":"2026-06-29T11:22:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RLSA-2025:8427","title":"Moderate: pandoc security update","description":"Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. It can read several dialects of Markdown and (subsets of) HTML, reStructuredText, LaTeX, DocBook, JATS, MediaWiki markup, TWiki markup, TikiWiki markup, Creole 1.0, Haddock markup, OPML, Emacs Org-Mode, Emacs Muse, txt2tags, Vimwiki, Word Docx, ODT, and Textile, and it can write Markdown, reStructuredText, XHTML, HTML 5, LaTeX, ConTeXt, DocBook, JATS, OPML, TEI, OpenDocument, ODT, Word docx, RTF, MediaWiki, DokuWiki, ZimWiki, Textile, groff man, groff ms, plain text, Emacs Org-Mode, AsciiDoc, Haddock markup, EPUB (v2 and v3), FictionBook2, InDesign ICML, Muse, LaTeX beamer slides, PowerPoint, and several kinds of HTML/JavaScript slide shows (S5, Slidy, Slideous, DZSlides, reveal.js).  In contrast to most existing tools for converting Markdown to HTML, pandoc has a modular design: it consists of a set of readers, which parse text in a given format and produce a native representation of the document, and a set of writers, which convert this native representation into a target format. Thus, adding an input or output format requires only adding a reader or writer.  For pdf output please also install pandoc-pdf.\n\nSecurity Fix(es):\n\n* cmark-gfm: Quadratic complexity bugs may lead to a denial of service (CVE-2023-24824)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:39:03.816508Z","modified":"2025-07-29T15:00:29.547137Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2023-24824","description":"cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `\u003e` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.","status":"published","published":"2023-03-31T23:15:00Z","modified":"2026-10-17T12:56:04.519464969Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"ALSA-2025:8427","title":"Moderate: pandoc security update","description":"Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. It can read several dialects of Markdown and (subsets of) HTML, reStructuredText, LaTeX, DocBook, JATS, MediaWiki markup, TWiki markup, TikiWiki markup, Creole 1.0, Haddock markup, OPML, Emacs Org-Mode, Emacs Muse, txt2tags, Vimwiki, Word Docx, ODT, and Textile, and it can write Markdown, reStructuredText, XHTML, HTML 5, LaTeX, ConTeXt, DocBook, JATS, OPML, TEI, OpenDocument, ODT, Word docx, RTF, MediaWiki, DokuWiki, ZimWiki, Textile, groff man, groff ms, plain text, Emacs Org-Mode, AsciiDoc, Haddock markup, EPUB (v2 and v3), FictionBook2, InDesign ICML, Muse, LaTeX beamer slides, PowerPoint, and several kinds of HTML/JavaScript slide shows (S5, Slidy, Slideous, DZSlides, reveal.js). In contrast to most existing tools for converting Markdown to HTML, pandoc has a modular design: it consists of a set of readers, which parse text in a given format and produce a native representation of the document, and a set of writers, which convert this native representation into a target format. Thus, adding an input or output format requires only adding a reader or writer. For pdf output please also install pandoc-pdf.  \n\nSecurity Fix(es):  \n\n  * cmark-gfm: Quadratic complexity bugs may lead to a denial of service (CVE-2023-24824)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-03T00:00:00Z","modified":"2026-10-29T11:02:23.340538418Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"HSEC-2025-0007","title":"cmark-gfm: resource exhaustion due to quadratic complexity in parser","description":"# cmark-gfm: resource exhaustion due to quadratic complexity in parser\n\n*cmark-gfm* is GitHub's fork of *cmark*, a CommonMark parsing and\nrendering library and program in C.  A polynomial time complexity\nissue in cmark-gfm may lead to unbounded resource exhaustion and\nsubsequent denial of service, due to quadratic complexity issues\nwhen parsing text which leads with either large numbers of `\u003e` or\n`-` characters.\n\nThe Haskell *cmark-gfm* package bundles the C sources and was\naffected by this issue.  This fix was released in the upstream C\npackage at version `0.29.0.gfm.10`.  Version `0.2.6` of the Haskell\npackage adopted the fix (moving from `0.29.0.gfm.6` to\n`0.29.0.gfm.13`).  Packages that depend on *cmark-gfm* should update\nto `0.2.6` or later.\n\nUsers unable to update should avoid processing data from untrusted\nsources or validate the input with other tools before using\n*cmark-gfm* to parse it.\n\nPandoc `\u003c 2.10.1` depended on *cmark-gfm* and could be affected by\nthis issue.\n","status":"published","published":"2025-12-27T08:58:56Z","modified":"2025-12-27T09:11:06.022958Z","updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"RSEC-2023-8","title":"Denial of Service (DoS) vulnerabilities","description":"cmark-gfm, GitHub's extended version of the CommonMark library in C, suffers from multiple vulnerabilities affecting versions prior to 0.29.0.gfm.12. Various issues, including polynomial time complexity in multiple components like autolink extension, handle_close_bracket, and parsing of certain text patterns (leading `\u003e`, `-`, `_`), may lead to unbounded resource exhaustion and denial of service. An out-of-bounds read in the `validate_protocol` function was also identified but is considered less harmful. Patches are available in versions 0.29.0.gfm.7, 0.29.0.gfm.10, and 0.29.0.gfm.12. Upgrading is advised, and users unable to upgrade should validate input from trusted sources.","status":"published","published":"2023-10-06T05:00:00.6Z","modified":"2025-05-19T19:43:48.265479Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}