Description
The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| github | cmark-gfm | < 0.29.0.gfm.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cmark-gfm | 0.29.0.gfm.2-1 | — |
| Debian 14 | haskell-cmark-gfm | 0.2.1+ds1-1 | — |
| Debian 14 | python-cmarkgfm | 0.7.0-1 | — |
| Debian 14 | r-cran-commonmark | 1.8.0-1 | — |
| Debian 14 | ruby-commonmarker | 0.21.0-1 | — |
| Debian 13 | cmark-gfm | 0.29.0.gfm.2-1 | — |
| Debian 13 | haskell-cmark-gfm | 0.2.1+ds1-1 | — |
| Debian 13 | python-cmarkgfm | 0.7.0-1 | — |
| Debian 13 | r-cran-commonmark | 1.8.0-1 | — |
| Debian 13 | ruby-commonmarker | 0.21.0-1 | — |
| Debian 12 | cmark-gfm | 0.29.0.gfm.2-1 | — |
| Debian 12 | haskell-cmark-gfm | 0.2.1+ds1-1 | — |
| Debian 12 | python-cmarkgfm | 0.7.0-1 | — |
| Debian 12 | r-cran-commonmark | 1.8.0-1 | — |
| Debian 12 | ruby-commonmarker | 0.21.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-cmarkgfm +2 | No fix yet | — |
| Ubuntu 26.04 LTS | python-cmarkgfm +2 | No fix yet | — |
| Ubuntu 25.10 | python-cmarkgfm +2 | No fix yet | — |
| Ubuntu 24.04 LTS | python-cmarkgfm +2 | No fix yet | — |
| Ubuntu 22.04 LTS | python-cmarkgfm +2 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | python-cmarkgfm +3 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | cmark-gfm | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | pandoc +1 | 2.0.6-5.el8 | RHSA-2021:1972 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | pandoc +1 | 2.0.6-5.el8 | ALSA-2021:1972 |
Advisories 2
- ALSA-2021:1972 Moderate: pandoc security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2021:1972 Red Hat Security Advisory: pandoc security update Red Hat Security Advisories (RHSA) · Jun 29, 2026