cmark-gfm prior 0.29.0.gfm.10 CommonMark Parsing resource consumption

Summaryinfo

A vulnerability was found in cmark-gfm and classified as problematic. The impacted element is an unknown function of the component CommonMark Parsing. Executing a manipulation can lead to resource consumption. The identification of this vulnerability is CVE-2023-24824. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in cmark-gfm. This vulnerability affects an unknown code of the component CommonMark Parsing. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.

The weakness was shared 04/01/2023 as GHSA-66g8-4hjf-77xh. The advisory is shared for download at github.com. This vulnerability was named CVE-2023-24824 since 01/30/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 237691 (RHEL 8 : pandoc (RHSA-2025:8427)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.29.0.gfm.10 eliminates this vulnerability. Applying the patch 2300c1bd2c8226108885bf019655c4159cf26b59 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (237691). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• cmark-gfm

Version

• 0.28.3.gfm.21
• 0.29.0.gfm.3
• 0.29.0.gfm.6
• 0.29.0.gfm.7

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion