CVE catalog

CVE-2023-37463

cmark-gfm: CVE-2023-37463

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.70% · Oct 25, 2026

cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancmark-gfmsid0.29.0.gfm.13-7.1fixed
Debiancmark-gfmforky0.29.0.gfm.13-7.1fixed
Debiancmark-gfmtrixie0.29.0.gfm.13-4fixed
Debiancmark-gfmbookworm0.29.0.gfm.6-6vulnerable
Debianpython-cmarkgfmsid2025.10.22-2fixed
Debianpython-cmarkgfmforky2025.10.22-2fixed
Debianpython-cmarkgfmtrixie2024.11.20-1fixed
Debianpython-cmarkgfmbookworm0.8.0-3vulnerable
Debianr-cran-commonmarksid2.0.0-3fixed
Debianr-cran-commonmarkforky2.0.0-3fixed
Debianr-cran-commonmarktrixie1.9.5-1fixed
Debianr-cran-commonmarkbookworm1.8.1-1vulnerable
Debianruby-commonmarkersid2.10.1-1fixed
Debianruby-commonmarkerforky2.10.0-2fixed
Debianruby-commonmarkertrixie0.23.10-1fixed
Debianruby-commonmarkerbookworm0.23.6-1vulnerable
Opensusepython-cmarkgfmtumbleweed2025.10.22-1.4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancmark-gfmsourcesid0.29.0.gfm.13-1not yet assignedNot reported[1041097]
Debiancmark-gfmsourceforky0.29.0.gfm.13-1not yet assignedNot reported[1041097]
Debiancmark-gfmsourcetrixie0.29.0.gfm.13-1not yet assignedNot reported[1041097]
Debiancmark-gfmsourcebookworm(unfixed)not yet assignedNot reported[1041097]
Debianpython-cmarkgfmsourcesid2024.11.20-1not yet assignedNot reported[1041098]
Debianpython-cmarkgfmsourceforky2024.11.20-1not yet assignedNot reported[1041098]
Debianpython-cmarkgfmsourcetrixie2024.11.20-1not yet assignedNot reported[1041098]
Debianpython-cmarkgfmsourcebookworm(unfixed)not yet assignedNot reported[1041098]
Debianr-cran-commonmarksourcesid1.9.1-1not yet assignedNot reported[1041099]
Debianr-cran-commonmarksourceforky1.9.1-1not yet assignedNot reported[1041099]
Debianr-cran-commonmarksourcetrixie1.9.1-1not yet assignedNot reported[1041099]
Debianr-cran-commonmarksourcebookworm(unfixed)not yet assignedNot reported[1041099]
Debianruby-commonmarkersourcesid0.23.10-1not yet assignedNot reported[1041100]
Debianruby-commonmarkersourceforky0.23.10-1not yet assignedNot reported[1041100]
Debianruby-commonmarkersourcetrixie0.23.10-1not yet assignedNot reported[1041100]
Debianruby-commonmarkersourcebookworm(unfixed)not yet assignedNot reported[1041100]
Opensusepython-cmarkgfmrpmtumbleweed2025.10.22-1.4Not reportedOPENSUSE-SU-2026:12003-1Not reported

[Debian bug #1041097][Debian bug #1041098][Debian bug #1041099][Debian bug #1041100]

Notes

[bookworm] cmark-gfm: Minor issue [bookworm] python-cmarkgfm: Minor issue [bookworm] r-cran-commonmark: Minor issue [bookworm] ruby-commonmarker: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]