Most recent entries from all

ALSA-2025:8427 — Moderate: pandoc security update

Affected: AlmaLinux:8: pandoc, AlmaLinux:8: pandoc-common

Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. It can read several dialects of Markdown and (subsets of) HTML, reStructuredText, LaTeX, DocBook, JATS, MediaWiki markup, TWiki markup, TikiWiki markup, Creole 1.0, Haddock markup, OPML, Emacs Org-Mode, Emacs Muse, txt2tags, Vimwiki, Word Docx, ODT, and Textile, and it can write Markdown, reStructuredText, XHTML, HTML 5, LaTeX, ConTeXt, DocBook, JATS, OPML, TEI, OpenDocument, ODT, Word docx, RTF, MediaWiki, DokuWiki, ZimWiki, Textile, groff man, groff ms, plain text, Emacs Org-Mode, AsciiDoc, Haddock markup, EPUB (v2 and v3), FictionBook2, InDesign ICML, Muse, LaTeX beamer slides, PowerPoint, and several kinds of HTML/JavaScript slide shows (S5, Slidy, Slideous, DZSlides, reveal.js). In contrast to most existing tools for converting Markdown to HTML, pandoc has a modular design: it consists of a set of readers, which parse text in a given format and produce a native representation of the document, and a set of writers, which convert this native representation into a target format. Thus, adding an input or output format requires only adding a reader or writer. For pdf output please also install pandoc-pdf.

Security Fix(es):

* cmark-gfm: Quadratic complexity bugs may lead to a denial of service (CVE-2023-24824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refe…

EUVD-2026-214711

fkie_cve-2023-24824

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.

gsd-2023-24824

HSEC-2025-0007 — cmark-gfm: resource exhaustion due to quadratic complexity in parser

Affected: Hackage: cmark-gfm

# cmark-gfm: resource exhaustion due to quadratic complexity in parser

*cmark-gfm* is GitHub's fork of *cmark*, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service, due to quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters.

The Haskell *cmark-gfm* package bundles the C sources and was affected by this issue. This fix was released in the upstream C package at version `0.29.0.gfm.10`. Version `0.2.6` of the Haskell package adopted the fix (moving from `0.29.0.gfm.6` to `0.29.0.gfm.13`). Packages that depend on *cmark-gfm* should update to `0.2.6` or later.

Users unable to update should avoid processing data from untrusted sources or validate the input with other tools before using *cmark-gfm* to parse it.

Pandoc `< 2.10.1` depended on *cmark-gfm* and could be affected by this issue.

RHSA-2025:8427 — Red Hat Security Advisory: pandoc security update

cmark-gfm: Quadratic complexity bugs may lead to a denial of service

UBUNTU-CVE-2023-24824

Affected: Ubuntu:18.04:LTS: cmark, Ubuntu:20.04:LTS: cmark, Ubuntu:22.04:LTS: cmark, Ubuntu:24.04:LTS: cmark, Ubuntu:25.10: cmark, Ubuntu:26.04:LTS: cmark

WID-SEC-W-2025-1213 — Red Hat Enterprise Linux (cmark-gfm): Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.