CVE-2022-24724

CVE-2022-24724 affects cmark-gfm, GitHub’s extended CommonMark reference implementation. A heap memory overflow in table.c:row_from_string can occur when parsing table rows with more than UINT16_MAX columns, leading to information disclosure or arbitrary code execution depending on usage. Affecte...

CVE-2023-22486

The CVE-2023-22486 issue affects cmark-gfm (GitHub’s fork of cmark). Versions prior to 0.29.0.gfm.7 contain a polynomial-time complexity bug in handle_close_bracket that can lead to unbounded resource exhaustion and denial of service. The vulnerability is explicitly noted as patched in 0.29.0.gfm...

CVE-2023-26485

CVE-2023-26485 affects cmark-gfm (GitHub’s fork of cmark) and causes a polynomial-time denial-of-service when parsing inputs with very large sequences of underscores, due to a quadratic complexity in parsing. The issue has been addressed in version 0.29.0.gfm.10 ; upgrading to this version (or ap...

CVE-2022-39209

CVE-2022-39209 concerns cmark-gfm, GitHub’s fork of cmark (C). A polynomial-time complexity issue in the autolink extension during input parsing can cause unbounded resource exhaustion, leading to denial of service. Affected versions are prior to 0.29.0.gfm.6; patched in 0.29.0.gfm.6. Upgrading t...

CVE-2024-22051

CommonMarker (cmark-gfm) before version 0.23.4 is vulnerable to an integer overflow in table row parsing that can cause heap memory corruption, potentially enabling unauthenticated remote attackers to leak information or execute code when parsing tables with more than UINT16_MAX columns. Affected...

CVE-2023-22484

The CVE-2023-22484 issue affects cmark-gfm, GitHub’s fork of the C library cmark. It describes a polynomial-time complexity vulnerability in cmark-gfm that can lead to unbounded resource exhaustion and denial of service on affected versions. According to linked documents, versions prior to 0.29.0...

CVE-2023-37463

CVE-2023-37463 affects cmark-gfm (GitHub’s CommonMark extension); three polynomial-time complexity issues may cause unbounded resource exhaustion and DoS. These were patched in version 0.29.0.gfm.12. Upgrade to 0.29.0.gfm.12 or newer to remediate.

CVE-2023-22483

CVE-2023-22483 affects cmark-gfm, GitHub’s fork of the CommonMark C library. The issue is a set of polynomial-time complexity vulnerabilities in cmark-gfm that can cause unbounded resource exhaustion and denial of service when parsing large inputs, affecting versions prior to 0.29.0.gfm.7. Severa...

CVE-2023-22485

CVE-2023-22485 affects cmark-gfm (GitHub’s fork of cmark, C) at versions prior to 0.29.0.gfm.7. The vulnerability is an out-of-bounds read in the validate_protocol function caused by parsing crafted Markdown; impact is described as benign in practice, reading malloc metadata without visible damag...

CVE-2023-24824

CVE-2023-24824 affects cmark-gfm (GitHub’s fork of cmark) in C, where quadratic/polynomial parsing complexity can exhaust resources and cause DoS when processing inputs that begin with many ‘>’ or ‘-’. The issue is mitigated by upgrading to upstream 0.29.0.gfm.10; downstream ecosystems (e.g., ...