https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 16:50:57 +0000 https://cve.radiocsirt.org/vuln/cve-2023-26485 <p><strong>Affected:</strong> github cmark-gfm</p> <p>cmark-gfm is GitHub&#39;s fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.</p> <p>### Impact</p> <p>A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.</p> <p>### Proof of concept</p> <p>``` $ ~/cmark-gfm$ python3 -c &#39;pad = &#34;_&#34; * 100000; print(pad + &#34;.&#34; + pad, end=&#34;&#34;)&#39; | time ./build/src/cmark-gfm --to plaintext ```</p> <p>Increasing the number 10000 in the above commands causes the running time to increase quadratically.</p> <p>### Patches</p> <p>This vulnerability have been patched in 0.29.0.gfm.10.</p> <p>### Note on cmark and cmark-gfm</p> <p>XXX: TBD</p> <p>[cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`.</p> <p>### Credit</p> <p>We would like to thank @gravypod for reporting this vulnerability.</p> <p>### References</p> <p>https://en.wikipedia.org/wiki/Time_complexity</p> <p>### For more information</p> <p>If you have any questions or comm…</p> <p><strong>Affected:</strong> github cmark-gfm</p> <p>cmark-gfm is GitHub&#39;s fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.</p> <p>### Impact</p> <p>A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.</p> <p>### Proof of concept</p> <p>``` $ ~/cmark-gfm$ python3 -c &#39;pad = &#34;_&#34; * 100000; print(pad + &#34;.&#34; + pad, end=&#34;&#34;)&#39; | time ./build/src/cmark-gfm --to plaintext ```</p> <p>Increasing the number 10000 in the above commands causes the running time to increase quadratically.</p> <p>### Patches</p> <p>This vulnerability have been patched in 0.29.0.gfm.10.</p> <p>### Note on cmark and cmark-gfm</p> <p>XXX: TBD</p> <p>[cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`.</p> <p>### Credit</p> <p>We would like to thank @gravypod for reporting this vulnerability.</p> <p>### References</p> <p>https://en.wikipedia.org/wiki/Time_complexity</p> <p>### For more information</p> <p>If you have any questions or comm…</p> https://cve.radiocsirt.org/vuln/cve-2023-26485