CVE-2023-22486

2023-01-2621:18:12

CWE-407

CWE-400

[email protected]

web.nvd.nist.gov

cmark-gfm

github

commonmark

unbounded resource exhaustion

denial of service

cve-2023-22486

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.1%

JSON

cmark-gfm is GitHub’s fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

Affected configurations

Vulners

NVD

Node

githubcmark-gfmRange<0.29.0.gfm.7

VendorProductVersionCPE
githubcmark\-gfm*cpe:2.3:a:github:cmark\-gfm:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
github	cmark\-gfm	*	cpe:2.3:a:github:cmark\-gfm::::::::

CNA Affected

[
  {
    "vendor": "github",
    "product": "cmark-gfm",
    "versions": [
      {
        "version": "< 0.29.0.gfm.7",
        "status": "affected"
      }
    ]
  }
]