CVE catalog

CVE-2023-22484

cmark-gfm vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.96% · Oct 25, 2026

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancmark-gfmsid0.29.0.gfm.13-7.1fixed
Debiancmark-gfmforky0.29.0.gfm.13-7.1fixed
Debiancmark-gfmtrixie0.29.0.gfm.13-4fixed
Debiancmark-gfmbookworm0.29.0.gfm.6-6vulnerable
Debianpython-cmarkgfmsid2025.10.22-2fixed
Debianpython-cmarkgfmforky2025.10.22-2fixed
Debianpython-cmarkgfmtrixie2024.11.20-1fixed
Debianpython-cmarkgfmbookworm0.8.0-3vulnerable
Debianr-cran-commonmarksid2.0.0-3fixed
Debianr-cran-commonmarkforky2.0.0-3fixed
Debianr-cran-commonmarktrixie1.9.5-1fixed
Debianr-cran-commonmarkbookworm1.8.1-1vulnerable
Debianruby-commonmarkersid2.10.1-1fixed
Debianruby-commonmarkerforky2.10.0-2fixed
Debianruby-commonmarkertrixie0.23.10-1fixed
Debianruby-commonmarkerbookworm0.23.6-1vulnerable
Ubuntucmark-gfmnobleNot reportedvulnerable
Ubuntupython-cmarkgfmnobleNot reportedvulnerable
Ubuntur-cran-commonmarknobleNot reportedvulnerable
Ubunturuby-commonmarkernobleNot reportedvulnerable
Ubuntucmark-gfmnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1fixed
Ubuntulibcmark-gfm-devnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1fixed
Ubuntulibcmark-gfm-extensions-devnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1fixed
Ubuntulibcmark-gfm-extensions0.29.0.gfm.6noble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1fixed
Ubuntulibcmark-gfm0.29.0.gfm.6noble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1fixed
Ubuntucmark-gfmpro0.29.0.gfm.6-6vulnerable
Ubuntucmark-gfmpro0.29.0.gfm.6-6build1vulnerable
Ubuntucmark-gfmpro0.29.0.gfm.6-6ubuntu0.24.04.1~esm1fixed
Ubuntucmark-gfm22.040.29.0.gfm.0-6vulnerable
Ubuntucmark-gfm22.040.29.0.gfm.2-1vulnerable
Ubuntucmark-gfm22.040.29.0.gfm.2-1+really.0.29.0.gfm.0ubuntu1vulnerable
Ubuntucmark-gfm22.040.29.0.gfm.2-2vulnerable
Ubuntucmark-gfm22.040.29.0.gfm.3-3vulnerable
Opensusecmarktumbleweed0.30.3-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancmark-gfmsourcesid0.29.0.gfm.13-1not yet assignedNot reported[1033110]
Debiancmark-gfmsourceforky0.29.0.gfm.13-1not yet assignedNot reported[1033110]
Debiancmark-gfmsourcetrixie0.29.0.gfm.13-1not yet assignedNot reported[1033110]
Debiancmark-gfmsourcebookworm(unfixed)not yet assignedNot reported[1033110]
Debianpython-cmarkgfmsourcesid2024.11.20-1not yet assignedNot reported[1033111]
Debianpython-cmarkgfmsourceforky2024.11.20-1not yet assignedNot reported[1033111]
Debianpython-cmarkgfmsourcetrixie2024.11.20-1not yet assignedNot reported[1033111]
Debianpython-cmarkgfmsourcebookworm(unfixed)not yet assignedNot reported[1033111]
Debianr-cran-commonmarksourcesid1.9.0-1not yet assignedNot reported[1033112]
Debianr-cran-commonmarksourceforky1.9.0-1not yet assignedNot reported[1033112]
Debianr-cran-commonmarksourcetrixie1.9.0-1not yet assignedNot reported[1033112]
Debianr-cran-commonmarksourcebookworm(unfixed)not yet assignedNot reported[1033112]
Debianruby-commonmarkersourcesid0.23.10-1not yet assignedNot reported[1033113]
Debianruby-commonmarkersourceforky0.23.10-1not yet assignedNot reported[1033113]
Debianruby-commonmarkersourcetrixie0.23.10-1not yet assignedNot reported[1033113]
Debianruby-commonmarkersourcebookworm(unfixed)not yet assignedNot reported[1033113]
Ubuntucmark-gfmdebnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntulibcmark-gfm-devdebnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntulibcmark-gfm-extensions-devdebnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntulibcmark-gfm-extensions0.29.0.gfm.6debnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntulibcmark-gfm0.29.0.gfm.6debnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntucmark-gfmdebpro0.29.0.gfm.6-6ubuntu0.24.04.1~esm1Not reportedUBUNTU-CVE-2023-22484Not reported
Opensusecmarkrpmtumbleweed0.30.3-1.1Not reportedOPENSUSE-SU-2024:12802-1Not reported

[Debian bug #1033110][Debian bug #1033111][Debian bug #1033112][Debian bug #1033113]

Notes

[bookworm] cmark-gfm: Minor issue [bookworm] python-cmarkgfm: Minor issue [bookworm] r-cran-commonmark: Minor issue [bookworm] ruby-commonmarker: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]