CVE-2023-24824
cmark-gfm: resource exhaustion due to quadratic complexity in parser
Description
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.
How to fix CVE-2023-24824
To remediate CVE-2023-24824, upgrade the affected package to a fixed version below.
- —no fix listed
- —no fix listed
- —no fix listed
- —no fix listed
- —upgrade to 0.2.6 or later
Is CVE-2023-24824 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (5)
- from 0
- from 0
- from 0
- from 0
- >= 0.1.0, < 0.2.6
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |