CVE catalog

CVE-2023-22486

cmark-gfm vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.11% · Oct 25, 2026

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancmark-gfmsid0.29.0.gfm.13-7.1fixed
Debiancmark-gfmforky0.29.0.gfm.13-7.1fixed
Debiancmark-gfmtrixie0.29.0.gfm.13-4fixed
Debiancmark-gfmbookworm0.29.0.gfm.6-6vulnerable
Debianpython-cmarkgfmsid2025.10.22-2fixed
Debianpython-cmarkgfmforky2025.10.22-2fixed
Debianpython-cmarkgfmtrixie2024.11.20-1fixed
Debianpython-cmarkgfmbookworm0.8.0-3vulnerable
Debianr-cran-commonmarksid2.0.0-3fixed
Debianr-cran-commonmarkforky2.0.0-3fixed
Debianr-cran-commonmarktrixie1.9.5-1fixed
Debianr-cran-commonmarkbookworm1.8.1-1vulnerable
Debianruby-commonmarkersid2.10.1-1fixed
Debianruby-commonmarkerforky2.10.0-2fixed
Debianruby-commonmarkertrixie0.23.10-1fixed
Debianruby-commonmarkerbookworm0.23.6-1vulnerable
Ubuntucmark-gfmnobleNot reportedvulnerable
Ubuntupython-cmarkgfmnobleNot reportedvulnerable
Ubuntur-cran-commonmarknobleNot reportedvulnerable
Ubunturuby-commonmarkernobleNot reportedvulnerable
Ubuntucmark-gfmnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1fixed
Ubuntulibcmark-gfm-devnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1fixed
Ubuntulibcmark-gfm-extensions-devnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1fixed
Ubuntulibcmark-gfm-extensions0.29.0.gfm.6noble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1fixed
Ubuntulibcmark-gfm0.29.0.gfm.6noble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1fixed
Susecmarklinux enterprise module for development tools 15 sp40.30.2-150400.3.3.1fixed
Susecmarklinux enterprise module for package hub 15 sp40.30.2-150400.3.3.1fixed
Opensusecmarkleap 15.40.30.2-150400.3.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancmark-gfmsourcesid0.29.0.gfm.13-1not yet assignedNot reported[1033110]
Debiancmark-gfmsourceforky0.29.0.gfm.13-1not yet assignedNot reported[1033110]
Debiancmark-gfmsourcetrixie0.29.0.gfm.13-1not yet assignedNot reported[1033110]
Debiancmark-gfmsourcebookworm(unfixed)not yet assignedNot reported[1033110]
Debianpython-cmarkgfmsourcesid2024.11.20-1not yet assignedNot reported[1033111]
Debianpython-cmarkgfmsourceforky2024.11.20-1not yet assignedNot reported[1033111]
Debianpython-cmarkgfmsourcetrixie2024.11.20-1not yet assignedNot reported[1033111]
Debianpython-cmarkgfmsourcebookworm(unfixed)not yet assignedNot reported[1033111]
Debianr-cran-commonmarksourcesid1.9.0-1not yet assignedNot reported[1033112]
Debianr-cran-commonmarksourceforky1.9.0-1not yet assignedNot reported[1033112]
Debianr-cran-commonmarksourcetrixie1.9.0-1not yet assignedNot reported[1033112]
Debianr-cran-commonmarksourcebookworm(unfixed)not yet assignedNot reported[1033112]
Debianruby-commonmarkersourcesid0.23.10-1not yet assignedNot reported[1033113]
Debianruby-commonmarkersourceforky0.23.10-1not yet assignedNot reported[1033113]
Debianruby-commonmarkersourcetrixie0.23.10-1not yet assignedNot reported[1033113]
Debianruby-commonmarkersourcebookworm(unfixed)not yet assignedNot reported[1033113]
Ubuntucmark-gfmdebnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntulibcmark-gfm-devdebnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntulibcmark-gfm-extensions-devdebnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntulibcmark-gfm-extensions0.29.0.gfm.6debnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntulibcmark-gfm0.29.0.gfm.6debnoble0.29.0.gfm.6-6ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Susecmarkrpmlinux enterprise module for development tools 15 sp40.30.2-150400.3.3.1Not reportedSUSE-SU-2023:1834-1Not reported
Susecmarkrpmlinux enterprise module for package hub 15 sp40.30.2-150400.3.3.1Not reportedSUSE-SU-2023:1834-1Not reported
Opensusecmarkrpmleap 15.40.30.2-150400.3.3.1Not reportedSUSE-SU-2023:1834-1Not reported

[Debian bug #1033110][Debian bug #1033111][Debian bug #1033112][Debian bug #1033113]

Notes

[bookworm] cmark-gfm: Minor issue [bookworm] python-cmarkgfm: Minor issue [bookworm] r-cran-commonmark: Minor issue [bookworm] ruby-commonmarker: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]