CVE catalog

CVE-2023-22485

cmark-gfm: CVE-2023-22485

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.72% · Oct 25, 2026

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancmark-gfmsid0.29.0.gfm.13-7.1fixed
Debiancmark-gfmforky0.29.0.gfm.13-7.1fixed
Debiancmark-gfmtrixie0.29.0.gfm.13-4fixed
Debiancmark-gfmbookworm0.29.0.gfm.6-6vulnerable
Debianpython-cmarkgfmsid2025.10.22-2fixed
Debianpython-cmarkgfmforky2025.10.22-2fixed
Debianpython-cmarkgfmtrixie2024.11.20-1fixed
Debianpython-cmarkgfmbookworm0.8.0-3vulnerable
Debianr-cran-commonmarksid2.0.0-3fixed
Debianr-cran-commonmarkforky2.0.0-3fixed
Debianr-cran-commonmarktrixie1.9.5-1fixed
Debianr-cran-commonmarkbookworm1.8.1-1vulnerable
Debianruby-commonmarkersid2.10.1-1fixed
Debianruby-commonmarkerforky2.10.0-2fixed
Debianruby-commonmarkertrixie0.23.10-1fixed
Debianruby-commonmarkerbookworm0.23.6-1vulnerable
Ubuntucmark-gfmpro0.28.3.gfm.20-3vulnerable
Ubuntucmark-gfmpro0.29.0.gfm.0-3vulnerable
Ubuntucmark-gfmpro0.29.0.gfm.0-4vulnerable
Ubuntucmark-gfmpro0.29.0.gfm.0-4ubuntu0.1~esm1vulnerable
Ubuntucmark-gfm22.040.29.0.gfm.0-6vulnerable
Ubuntucmark-gfm22.040.29.0.gfm.2-1vulnerable
Ubuntucmark-gfm22.040.29.0.gfm.2-1+really.0.29.0.gfm.0ubuntu1vulnerable
Ubuntucmark-gfm22.040.29.0.gfm.2-2vulnerable
Ubuntucmark-gfm22.040.29.0.gfm.3-3vulnerable
Ubuntucmark-gfm24.040.29.0.gfm.6-6vulnerable
Ubuntucmark-gfm24.040.29.0.gfm.6-6build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancmark-gfmsourcesid0.29.0.gfm.13-1not yet assignedNot reported[1033110]
Debiancmark-gfmsourceforky0.29.0.gfm.13-1not yet assignedNot reported[1033110]
Debiancmark-gfmsourcetrixie0.29.0.gfm.13-1not yet assignedNot reported[1033110]
Debiancmark-gfmsourcebookworm(unfixed)not yet assignedNot reported[1033110]
Debianpython-cmarkgfmsourcesid2024.11.20-1not yet assignedNot reported[1033111]
Debianpython-cmarkgfmsourceforky2024.11.20-1not yet assignedNot reported[1033111]
Debianpython-cmarkgfmsourcetrixie2024.11.20-1not yet assignedNot reported[1033111]
Debianpython-cmarkgfmsourcebookworm(unfixed)not yet assignedNot reported[1033111]
Debianr-cran-commonmarksourcesid1.9.0-1not yet assignedNot reported[1033112]
Debianr-cran-commonmarksourceforky1.9.0-1not yet assignedNot reported[1033112]
Debianr-cran-commonmarksourcetrixie1.9.0-1not yet assignedNot reported[1033112]
Debianr-cran-commonmarksourcebookworm(unfixed)not yet assignedNot reported[1033112]
Debianruby-commonmarkersourcesid0.23.10-1not yet assignedNot reported[1033113]
Debianruby-commonmarkersourceforky0.23.10-1not yet assignedNot reported[1033113]
Debianruby-commonmarkersourcetrixie0.23.10-1not yet assignedNot reported[1033113]
Debianruby-commonmarkersourcebookworm(unfixed)not yet assignedNot reported[1033113]

[Debian bug #1033110][Debian bug #1033111][Debian bug #1033112][Debian bug #1033113]

Notes

[bookworm] cmark-gfm: Minor issue [bookworm] python-cmarkgfm: Minor issue [bookworm] r-cran-commonmark: Minor issue [bookworm] ruby-commonmarker: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]