Bug 2210172 (CVE-2023-24824) - CVE-2023-24824 cmark-gfm: Quadratic complexity bugs may lead to a denial of service
Summary: CVE-2023-24824 cmark-gfm: Quadratic complexity bugs may lead to a denial of s...
Keywords:
Status: NEW
Alias: CVE-2023-24824
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2210312 2210313 2210646
Blocks: 2210175
TreeView+ depends on / blocked
 
Reported: 2023-05-26 03:49 UTC by Avinash Hanwate
Modified: 2025-06-03 00:41 UTC (History)
10 users (show)

Fixed In Version: cmark-gfm 0.29.0.gfm.10
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:8427 0 None None None 2025-06-03 00:41:19 UTC

Description Avinash Hanwate 2023-05-26 03:49:56 UTC 
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.

https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
Comment 2 Patrick Del Bello 2023-05-26 14:49:13 UTC 
Created ghc-cmark-gfm tracking bugs for this issue:

Affects: fedora-all [bug 2210312]


Created ghostwriter tracking bugs for this issue:

Affects: fedora-all [bug 2210313]
Comment 8 errata-xmlrpc 2025-06-03 00:41:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:8427 https://access.redhat.com/errata/RHSA-2025:8427
Note You need to log in before you can comment on or make changes to this bug.