RSEC-2023-8
Denial of Service (DoS) vulnerabilities
Published Oct 6, 2023 · updated May 19, 2025
cmark-gfm, GitHub's extended version of the CommonMark library in C, suffers from multiple vulnerabilities affecting versions prior to 0.29.0.gfm.12. Various issues, including polynomial time complexity in multiple components like autolink extension, handle_close_bracket, and parsing of certain text patterns (leading , , ), may lead to unbounded resource exhaustion and denial of service. An out-of-bounds read in the function was also identified but is considered less harmful. Patches are available in versions 0.29.0.gfm.7, 0.29.0.gfm.10, and 0.29.0.gfm.12. Upgrading is advised, and users unable to upgrade should validate input from trusted sources.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 6, 2023 · OSV.dev
Detected
cmark-gfm, GitHub's extended version of the CommonMark library in C, suffers from multiple vulnerabilities affecting versions prior to 0.29.0.gfm.12. Various issues, including polynomial time complexity in multiple components like autolink extension, handle_close_bracket, and parsing of certain text patterns (leading , , ), may lead to unbounded resource exhaustion and denial of service. An out-of
May 19, 2025 · OSV.dev
Fix available
commonmark fixed in 1.9.2
May 19, 2025 · OSV.dev
Fix available
commonmark fixed in 1.9.2
May 19, 2025 · OSV.dev
Updated
cmark-gfm, GitHub's extended version of the CommonMark library in C, suffers from multiple vulnerabilities affecting versions prior to 0.29.0.gfm.12. Various issues, including polynomial time complexity in multiple components like autolink extension, handle_close_bracket, and parsing of certain text patterns (leading , , ), may lead to unbounded resource exhaustion and denial of service. An out-of
Affected
- CRAN commonmark0.2 → 1.9.2