Skip to content
OpenAdvisories
Low · 3.5 CVE-2023-22484 EUVD-2023-26631

Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of service

Published Jan 23, 2023 · Updated Mar 10, 2025 · Assigned by GitHub_M

Vendor: GitHub Product: cmark-gfm Package: cmark-gfm Package: cmark-gfm Package: python-cmarkgfm Package: r-cran-commonmark Package: ruby-commonmarker Ecosystem: Debian Ecosystem: Ubuntu

Description

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

Affected products

VendorProductAffectedFixed
github cmark-gfm < 0.29.0.gfm.7 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 cmark-gfm 0.29.0.gfm.13-1 —
Debian 14 python-cmarkgfm 2024.11.20-1 —
Debian 14 r-cran-commonmark 1.9.0-1 —
Debian 14 ruby-commonmarker 0.23.10-1 —
Debian 13 cmark-gfm 0.29.0.gfm.13-1 —
Debian 13 python-cmarkgfm 2024.11.20-1 —
Debian 13 r-cran-commonmark 1.9.0-1 —
Debian 13 ruby-commonmarker 0.23.10-1 —
Debian 12 cmark-gfm +3 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS cmark-gfm No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS cmark-gfm 0.29.0.gfm.6-6ubuntu0.24.04.1~esm1 USN-7319-1
Ubuntu Pro 22.04 LTS cmark-gfm 0.29.0.gfm.3-3ubuntu0.1~esm1 USN-7319-1
Ubuntu Pro 20.04 LTS cmark-gfm 0.29.0.gfm.0-4ubuntu0.1~esm1 USN-7319-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed cmark 0.30.3-1.1 openSUSE-SU-2024:12802-1

Advisories 2

References