CVE-2022-21680: fedoraproject fedora Uncontrolled Resource Consumption

Vulnerability summary

CVE-2022-21680 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in fedoraproject fedora. EPSS estimates a 2.85% chance of exploitation in the next 30 days, higher than 86.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 14-01-2022
   PublishedVulnerability first disclosed.
2. 22-04-2025
   Last modifiedVulnerability information updated.

Description

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.