CVE-2023-22486: github cmark-gfm Uncontrolled Resource Consumption
Vulnerability summary
CVE-2023-22486 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in github cmark-gfm. EPSS estimates a 1.11% chance of exploitation in the next 30 days, higher than 65.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 24-01-2023PublishedVulnerability first disclosed.
- 10-03-2025Last modifiedVulnerability information updated.
Description
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA3.5LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.11%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.11% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCmark Gfm
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Affected systems
Debian4 products
- cmark-gfmAll versions (No fix recorded) | < 0.29.0.gfm.13-1
- python-cmarkgfmAll versions (No fix recorded) | < 2024.11.20-1
- r-cran-commonmarkAll versions (No fix recorded) | < 1.9.0-1
- ruby-commonmarkerAll versions (No fix recorded) | < 0.23.10-1
Suse2 products
- cmark&distro=SUSE Linux Enterprise Module for Development Tools 15 SP4< 0.30.2-150400.3.3.1
- cmark&distro=SUSE Linux Enterprise Module for Package Hub 15 SP4< 0.30.2-150400.3.3.1
Ubuntu2 products
- cmarkAll versions (No fix recorded)
- cmark-gfm< 0.29.0.gfm.0-4ubuntu0.1~esm1 | < 0.29.0.gfm.3-3ubuntu0.1~esm1 | < 0.29.0.gfm.6-6ubuntu0.24.04.1~esm1
Github1 product
- cmark-gfm< 0.29.0.gfm.7
Opensuse1 product
- cmark&distro=openSUSE Leap 15.4< 0.30.2-150400.3.3.1
5 vendors · 10 products
References
8 links- github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8pX Refsource CONFIRMREPORTExploitThird Party Advisory
