Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-brhv-976k-sbhe

Summary The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.

Aliases

alias	CVE-2020-5238

Fixed_packages

url	pkg:deb/debian/cmark-gfm@0.29.0.gfm.2-1?distro=trixie
purl	pkg:deb/debian/cmark-gfm@0.29.0.gfm.2-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/cmark-gfm@0.29.0.gfm.2-1%3Fdistro=trixie

url pkg:deb/debian/cmark-gfm@0.29.0.gfm.6-6

purl pkg:deb/debian/cmark-gfm@0.29.0.gfm.6-6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/cmark-gfm@0.29.0.gfm.6-6

url pkg:deb/debian/cmark-gfm@0.29.0.gfm.6-6?distro=trixie

purl pkg:deb/debian/cmark-gfm@0.29.0.gfm.6-6?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/cmark-gfm@0.29.0.gfm.6-6%3Fdistro=trixie

url	pkg:deb/debian/cmark-gfm@0.29.0.gfm.13-4?distro=trixie
purl	pkg:deb/debian/cmark-gfm@0.29.0.gfm.13-4?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/cmark-gfm@0.29.0.gfm.13-4%3Fdistro=trixie

url	pkg:deb/debian/cmark-gfm@0.29.0.gfm.13-7.1?distro=trixie
purl	pkg:deb/debian/cmark-gfm@0.29.0.gfm.13-7.1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/cmark-gfm@0.29.0.gfm.13-7.1%3Fdistro=trixie

url	pkg:deb/debian/haskell-cmark-gfm@0.2.1%2Bds1-1
purl	pkg:deb/debian/haskell-cmark-gfm@0.2.1%2Bds1-1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/haskell-cmark-gfm@0.2.1%252Bds1-1

url	pkg:deb/debian/haskell-cmark-gfm@0.2.1%2Bds1-1?distro=trixie
purl	pkg:deb/debian/haskell-cmark-gfm@0.2.1%2Bds1-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/haskell-cmark-gfm@0.2.1%252Bds1-1%3Fdistro=trixie

url	pkg:deb/debian/haskell-cmark-gfm@0.2.5%2Bds1-1?distro=trixie
purl	pkg:deb/debian/haskell-cmark-gfm@0.2.5%2Bds1-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/haskell-cmark-gfm@0.2.5%252Bds1-1%3Fdistro=trixie

url	pkg:deb/debian/haskell-cmark-gfm@0.2.6%2Bds1-1?distro=trixie
purl	pkg:deb/debian/haskell-cmark-gfm@0.2.6%2Bds1-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/haskell-cmark-gfm@0.2.6%252Bds1-1%3Fdistro=trixie

url	pkg:deb/debian/haskell-cmark-gfm@0.2.6%2Bds1-3?distro=trixie
purl	pkg:deb/debian/haskell-cmark-gfm@0.2.6%2Bds1-3?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/haskell-cmark-gfm@0.2.6%252Bds1-3%3Fdistro=trixie

url	pkg:deb/debian/python-cmarkgfm@0.7.0-1?distro=trixie
purl	pkg:deb/debian/python-cmarkgfm@0.7.0-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/python-cmarkgfm@0.7.0-1%3Fdistro=trixie

url pkg:deb/debian/python-cmarkgfm@0.8.0-3?distro=trixie

purl pkg:deb/debian/python-cmarkgfm@0.8.0-3?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-22uj-nmkk-jbfr

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/python-cmarkgfm@0.8.0-3%3Fdistro=trixie

url pkg:deb/debian/python-cmarkgfm@0.8.0-3

purl pkg:deb/debian/python-cmarkgfm@0.8.0-3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-22uj-nmkk-jbfr

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/python-cmarkgfm@0.8.0-3

url	pkg:deb/debian/python-cmarkgfm@2024.11.20-1?distro=trixie
purl	pkg:deb/debian/python-cmarkgfm@2024.11.20-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/python-cmarkgfm@2024.11.20-1%3Fdistro=trixie

url	pkg:deb/debian/python-cmarkgfm@2025.10.22-2?distro=trixie
purl	pkg:deb/debian/python-cmarkgfm@2025.10.22-2?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/python-cmarkgfm@2025.10.22-2%3Fdistro=trixie

url	pkg:deb/debian/r-cran-commonmark@1.8.0-1?distro=trixie
purl	pkg:deb/debian/r-cran-commonmark@1.8.0-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/r-cran-commonmark@1.8.0-1%3Fdistro=trixie

url pkg:deb/debian/r-cran-commonmark@1.8.1-1

purl pkg:deb/debian/r-cran-commonmark@1.8.1-1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/r-cran-commonmark@1.8.1-1

url pkg:deb/debian/r-cran-commonmark@1.8.1-1?distro=trixie

purl pkg:deb/debian/r-cran-commonmark@1.8.1-1?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/r-cran-commonmark@1.8.1-1%3Fdistro=trixie

url	pkg:deb/debian/r-cran-commonmark@1.9.5-1?distro=trixie
purl	pkg:deb/debian/r-cran-commonmark@1.9.5-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/r-cran-commonmark@1.9.5-1%3Fdistro=trixie

url	pkg:deb/debian/r-cran-commonmark@2.0.0-2?distro=trixie
purl	pkg:deb/debian/r-cran-commonmark@2.0.0-2?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/r-cran-commonmark@2.0.0-2%3Fdistro=trixie

url pkg:deb/debian/ruby-commonmarker@0.21.0-1?distro=trixie

purl pkg:deb/debian/ruby-commonmarker@0.21.0-1?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1z6r-htju-wkhp

vulnerability	VCID-22uj-nmkk-jbfr

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-ph5n-2d4n-mfd3

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.21.0-1%3Fdistro=trixie

url pkg:deb/debian/ruby-commonmarker@0.21.0-1

purl pkg:deb/debian/ruby-commonmarker@0.21.0-1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1z6r-htju-wkhp

vulnerability	VCID-22uj-nmkk-jbfr

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-ph5n-2d4n-mfd3

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.21.0-1

url pkg:deb/debian/ruby-commonmarker@0.23.6-1?distro=trixie

purl pkg:deb/debian/ruby-commonmarker@0.23.6-1?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-22uj-nmkk-jbfr

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.6-1%3Fdistro=trixie

url	pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
purl	pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie

Affected_packages

url pkg:deb/debian/cmark-gfm@0.29.0.gfm.0-6

purl pkg:deb/debian/cmark-gfm@0.29.0.gfm.0-6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1z6r-htju-wkhp

vulnerability	VCID-22uj-nmkk-jbfr

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-brhv-976k-sbhe

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/cmark-gfm@0.29.0.gfm.0-6

url pkg:deb/debian/cmark-gfm@0.29.0.gfm.0-6?distro=trixie

purl pkg:deb/debian/cmark-gfm@0.29.0.gfm.0-6?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1z6r-htju-wkhp

vulnerability	VCID-22uj-nmkk-jbfr

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-brhv-976k-sbhe

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/cmark-gfm@0.29.0.gfm.0-6%3Fdistro=trixie

url pkg:deb/debian/haskell-cmark-gfm@0.1.5-2

purl pkg:deb/debian/haskell-cmark-gfm@0.1.5-2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-brhv-976k-sbhe

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/haskell-cmark-gfm@0.1.5-2

url pkg:deb/debian/python-cmarkgfm@0.4.2-1?distro=trixie

purl pkg:deb/debian/python-cmarkgfm@0.4.2-1?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1z6r-htju-wkhp

vulnerability	VCID-22uj-nmkk-jbfr

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-brhv-976k-sbhe

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/python-cmarkgfm@0.4.2-1%3Fdistro=trixie

url pkg:deb/debian/python-cmarkgfm@0.4.2-1

purl pkg:deb/debian/python-cmarkgfm@0.4.2-1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1z6r-htju-wkhp

vulnerability	VCID-22uj-nmkk-jbfr

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-brhv-976k-sbhe

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/python-cmarkgfm@0.4.2-1

url pkg:deb/debian/r-cran-commonmark@1.7-2

purl pkg:deb/debian/r-cran-commonmark@1.7-2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1z6r-htju-wkhp

vulnerability	VCID-22uj-nmkk-jbfr

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-brhv-976k-sbhe

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/r-cran-commonmark@1.7-2

url pkg:deb/debian/r-cran-commonmark@1.7-2?distro=trixie

purl pkg:deb/debian/r-cran-commonmark@1.7-2?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1z6r-htju-wkhp

vulnerability	VCID-22uj-nmkk-jbfr

vulnerability	VCID-29sg-t6ye-2kbh

vulnerability	VCID-4d5b-yhjq-7ka7

vulnerability	VCID-7s8k-utv9-1qfs

vulnerability	VCID-brhv-976k-sbhe

vulnerability	VCID-gkxf-yuu8-gyfg

vulnerability	VCID-p384-h1h3-z7bt

vulnerability	VCID-uqng-ft4x-3ydj

vulnerability	VCID-uw1x-u1gn-2yd1

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/r-cran-commonmark@1.7-2%3Fdistro=trixie

url pkg:deb/debian/ruby-commonmarker@0.17.9-1

purl pkg:deb/debian/ruby-commonmarker@0.17.9-1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-brhv-976k-sbhe

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.17.9-1

url pkg:rpm/redhat/pandoc@2.0.6-5?arch=el8

purl pkg:rpm/redhat/pandoc@2.0.6-5?arch=el8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-brhv-976k-sbhe

resource_url http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/pandoc@2.0.6-5%3Farch=el8

References

reference_url

https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5238.json

reference_id

reference_type

scores

value	6.5
scoring_system	cvssv3
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

url

https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5238.json

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2020-5238

reference_id

reference_type

scores

value	0.00509
scoring_system	epss
scoring_elements	0.66696
published_at	2026-06-04T12:55:00Z

value	0.00509
scoring_system	epss
scoring_elements	0.66738
published_at	2026-06-05T12:55:00Z

value	0.00509
scoring_system	epss
scoring_elements	0.66745
published_at	2026-06-06T12:55:00Z

value	0.00509
scoring_system	epss
scoring_elements	0.66731
published_at	2026-06-07T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2020-5238

reference_url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5238
reference_id
reference_type
scores
url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5238

reference_url	https://bugzilla.redhat.com/show_bug.cgi?id=1854328
reference_id	1854328
reference_type
scores
url	https://bugzilla.redhat.com/show_bug.cgi?id=1854328

reference_url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965980
reference_id	965980
reference_type
scores
url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965980

reference_url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965981
reference_id	965981
reference_type
scores
url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965981

reference_url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965982
reference_id	965982
reference_type
scores
url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965982

reference_url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965983
reference_id	965983
reference_type
scores
url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965983

reference_url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965984
reference_id	965984
reference_type
scores
url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965984

reference_url	https://access.redhat.com/errata/RHSA-2021:1972
reference_id	RHSA-2021:1972
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2021:1972

Weaknesses

cwe_id	20
name	Improper Input Validation
description	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Exploits

Severity_range_score 6.5 - 6.5

Exploitability 0.5

Weighted_severity 5.9

Risk_score 3.0

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-brhv-976k-sbhe

Vulnerability Instance