Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
Typedeb
Namespacedebian
Nameruby-commonmarker
Version0.23.10-1
Qualifiers
distro trixie
Subpath
Is_vulnerablefalse
Next_non_vulnerable_versionnull
Latest_non_vulnerable_versionnull
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-1z6r-htju-wkhp
vulnerability_id VCID-1z6r-htju-wkhp
summary cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24724.json
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24724.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-24724
reference_id
reference_type
scores
0
value 0.04189
scoring_system epss
scoring_elements 0.88926
published_at 2026-06-05T12:55:00Z
1
value 0.04189
scoring_system epss
scoring_elements 0.88909
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-24724
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24724
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24724
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006756
reference_id 1006756
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006756
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006757
reference_id 1006757
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006757
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006758
reference_id 1006758
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006758
6
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006759
reference_id 1006759
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006759
7
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006760
reference_id 1006760
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006760
8
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2060662
reference_id 2060662
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2060662
9
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5CYUU662VO6CCXQKVZVOHXX3RGIF2DLQ/
reference_id 5CYUU662VO6CCXQKVZVOHXX3RGIF2DLQ
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:44:15Z/
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5CYUU662VO6CCXQKVZVOHXX3RGIF2DLQ/
10
reference_url http://packetstormsecurity.com/files/166599/cmark-gfm-Integer-overflow.html
reference_id cmark-gfm-Integer-overflow.html
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:44:15Z/
url http://packetstormsecurity.com/files/166599/cmark-gfm-Integer-overflow.html
11
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7V3HAM5H6YFJG2QFEXACZR3XVWFTXTC/
reference_id F7V3HAM5H6YFJG2QFEXACZR3XVWFTXTC
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:44:15Z/
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7V3HAM5H6YFJG2QFEXACZR3XVWFTXTC/
12
reference_url https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
reference_id GHSA-mc3g-88wq-6f4x
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:44:15Z/
url https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
13
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KH4UQA6VWVZU5EW3HNEAB7D7BTCNJSJ2/
reference_id KH4UQA6VWVZU5EW3HNEAB7D7BTCNJSJ2
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:44:15Z/
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KH4UQA6VWVZU5EW3HNEAB7D7BTCNJSJ2/
14
reference_url https://access.redhat.com/errata/RHSA-2022:5597
reference_id RHSA-2022:5597
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:5597
15
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSKUOJ2VAYGTJXPDE2RRPMNLVVMKCI77/
reference_id RSKUOJ2VAYGTJXPDE2RRPMNLVVMKCI77
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:44:15Z/
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSKUOJ2VAYGTJXPDE2RRPMNLVVMKCI77/
16
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TJBFIJEHJZEEDG6MO4MQHZYKUXELH77O/
reference_id TJBFIJEHJZEEDG6MO4MQHZYKUXELH77O
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:44:15Z/
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TJBFIJEHJZEEDG6MO4MQHZYKUXELH77O/
17
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55K6VNVKO2G5SNKRCQ2KDG5SKTX5PVV/
reference_id Z55K6VNVKO2G5SNKRCQ2KDG5SKTX5PVV
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:44:15Z/
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55K6VNVKO2G5SNKRCQ2KDG5SKTX5PVV/
fixed_packages
0
url pkg:deb/debian/ruby-commonmarker@0.23.4-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.4-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.4-1%3Fdistro=trixie
1
url pkg:deb/debian/ruby-commonmarker@0.23.6-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.6-1?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-22uj-nmkk-jbfr
1
vulnerability VCID-29sg-t6ye-2kbh
2
vulnerability VCID-4d5b-yhjq-7ka7
3
vulnerability VCID-7s8k-utv9-1qfs
4
vulnerability VCID-gkxf-yuu8-gyfg
5
vulnerability VCID-p384-h1h3-z7bt
6
vulnerability VCID-uqng-ft4x-3ydj
7
vulnerability VCID-uw1x-u1gn-2yd1
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.6-1%3Fdistro=trixie
2
url pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie
aliases CVE-2022-24724
risk_score 4.0
exploitability 0.5
weighted_severity 7.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1z6r-htju-wkhp
1
url VCID-22uj-nmkk-jbfr
vulnerability_id VCID-22uj-nmkk-jbfr
summary cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-39209.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-39209.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-39209
reference_id
reference_type
scores
0
value 0.01827
scoring_system epss
scoring_elements 0.83238
published_at 2026-06-04T12:55:00Z
1
value 0.01827
scoring_system epss
scoring_elements 0.83264
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-39209
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39209
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39209
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1020588
reference_id 1020588
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1020588
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034887
reference_id 1034887
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034887
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034888
reference_id 1034888
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034888
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2128044
reference_id 2128044
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2128044
7
reference_url https://github.com/github/cmark-gfm/commit/9d57d8a23142b316282bdfc954cb0ecda40a8655
reference_id 9d57d8a23142b316282bdfc954cb0ecda40a8655
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:51:25Z/
url https://github.com/github/cmark-gfm/commit/9d57d8a23142b316282bdfc954cb0ecda40a8655
8
reference_url https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q
reference_id GHSA-cgh3-p57x-9q7q
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:51:25Z/
url https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q
9
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUCZN3PEKUCT2JQYQTYOVIJG2KSD6G7/
reference_id JIUCZN3PEKUCT2JQYQTYOVIJG2KSD6G7
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:51:25Z/
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUCZN3PEKUCT2JQYQTYOVIJG2KSD6G7/
10
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMGP65NANDVKPDMXMKYO2ZV2H2HZJY4P/
reference_id JMGP65NANDVKPDMXMKYO2ZV2H2HZJY4P
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:51:25Z/
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMGP65NANDVKPDMXMKYO2ZV2H2HZJY4P/
11
reference_url https://en.wikipedia.org/wiki/Time_complexity
reference_id Time_complexity
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:51:25Z/
url https://en.wikipedia.org/wiki/Time_complexity
12
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEAAAI4OULDYQ2TA3HOXH54PC3DCBFZS/
reference_id UEAAAI4OULDYQ2TA3HOXH54PC3DCBFZS
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:51:25Z/
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEAAAI4OULDYQ2TA3HOXH54PC3DCBFZS/
13
reference_url https://usn.ubuntu.com/7319-1/
reference_id USN-7319-1
reference_type
scores
url https://usn.ubuntu.com/7319-1/
fixed_packages
0
url pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie
aliases CVE-2022-39209
risk_score 3.0
exploitability 0.5
weighted_severity 5.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-22uj-nmkk-jbfr
2
url VCID-29sg-t6ye-2kbh
vulnerability_id VCID-29sg-t6ye-2kbh
summary cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-24824.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-24824.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-24824
reference_id
reference_type
scores
0
value 0.00319
scoring_system epss
scoring_elements 0.55321
published_at 2026-06-05T12:55:00Z
1
value 0.00319
scoring_system epss
scoring_elements 0.55263
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-24824
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24824
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24824
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034171
reference_id 1034171
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034171
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034172
reference_id 1034172
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034172
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034173
reference_id 1034173
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034173
6
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034174
reference_id 1034174
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034174
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2210172
reference_id 2210172
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2210172
8
reference_url https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
reference_id 2300c1bd2c8226108885bf019655c4159cf26b59
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-11T17:19:34Z/
url https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
9
reference_url https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
reference_id GHSA-66g8-4hjf-77xh
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-11T17:19:34Z/
url https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
10
reference_url https://access.redhat.com/errata/RHSA-2025:8427
reference_id RHSA-2025:8427
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:8427
fixed_packages
0
url pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie
aliases CVE-2023-24824
risk_score 3.4
exploitability 0.5
weighted_severity 6.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-29sg-t6ye-2kbh
3
url VCID-4d5b-yhjq-7ka7
vulnerability_id VCID-4d5b-yhjq-7ka7
summary cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-22484
reference_id
reference_type
scores
0
value 0.00226
scoring_system epss
scoring_elements 0.45421
published_at 2026-06-04T12:55:00Z
1
value 0.00226
scoring_system epss
scoring_elements 0.4549
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-22484
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22484
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22484
2
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033110
reference_id 1033110
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033110
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033111
reference_id 1033111
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033111
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033112
reference_id 1033112
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033112
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033113
reference_id 1033113
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033113
6
reference_url https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r
reference_id GHSA-24f7-9frr-5h2r
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-10T21:01:30Z/
url https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r
7
reference_url https://usn.ubuntu.com/7319-1/
reference_id USN-7319-1
reference_type
scores
url https://usn.ubuntu.com/7319-1/
fixed_packages
0
url pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie
aliases CVE-2023-22484
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4d5b-yhjq-7ka7
4
url VCID-7s8k-utv9-1qfs
vulnerability_id VCID-7s8k-utv9-1qfs
summary cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0.29.0.gfm.7.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-22483
reference_id
reference_type
scores
0
value 0.00226
scoring_system epss
scoring_elements 0.45421
published_at 2026-06-04T12:55:00Z
1
value 0.00226
scoring_system epss
scoring_elements 0.4549
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-22483
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22483
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22483
2
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033110
reference_id 1033110
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033110
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033111
reference_id 1033111
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033111
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033112
reference_id 1033112
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033112
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033113
reference_id 1033113
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033113
6
reference_url https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c
reference_id GHSA-29g3-96g3-jg6c
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-10T21:01:33Z/
url https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c
7
reference_url https://usn.ubuntu.com/7319-1/
reference_id USN-7319-1
reference_type
scores
url https://usn.ubuntu.com/7319-1/
fixed_packages
0
url pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie
aliases CVE-2023-22483
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7s8k-utv9-1qfs
5
url VCID-brhv-976k-sbhe
vulnerability_id VCID-brhv-976k-sbhe
summary The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5238.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5238.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-5238
reference_id
reference_type
scores
0
value 0.00509
scoring_system epss
scoring_elements 0.66696
published_at 2026-06-04T12:55:00Z
1
value 0.00509
scoring_system epss
scoring_elements 0.66738
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-5238
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5238
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5238
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1854328
reference_id 1854328
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1854328
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965980
reference_id 965980
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965980
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965981
reference_id 965981
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965981
6
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965982
reference_id 965982
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965982
7
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965983
reference_id 965983
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965983
8
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965984
reference_id 965984
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965984
9
reference_url https://access.redhat.com/errata/RHSA-2021:1972
reference_id RHSA-2021:1972
reference_type
scores
url https://access.redhat.com/errata/RHSA-2021:1972
fixed_packages
0
url pkg:deb/debian/ruby-commonmarker@0.21.0-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.21.0-1?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1z6r-htju-wkhp
1
vulnerability VCID-22uj-nmkk-jbfr
2
vulnerability VCID-29sg-t6ye-2kbh
3
vulnerability VCID-4d5b-yhjq-7ka7
4
vulnerability VCID-7s8k-utv9-1qfs
5
vulnerability VCID-gkxf-yuu8-gyfg
6
vulnerability VCID-p384-h1h3-z7bt
7
vulnerability VCID-ph5n-2d4n-mfd3
8
vulnerability VCID-uqng-ft4x-3ydj
9
vulnerability VCID-uw1x-u1gn-2yd1
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.21.0-1%3Fdistro=trixie
1
url pkg:deb/debian/ruby-commonmarker@0.23.6-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.6-1?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-22uj-nmkk-jbfr
1
vulnerability VCID-29sg-t6ye-2kbh
2
vulnerability VCID-4d5b-yhjq-7ka7
3
vulnerability VCID-7s8k-utv9-1qfs
4
vulnerability VCID-gkxf-yuu8-gyfg
5
vulnerability VCID-p384-h1h3-z7bt
6
vulnerability VCID-uqng-ft4x-3ydj
7
vulnerability VCID-uw1x-u1gn-2yd1
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.6-1%3Fdistro=trixie
2
url pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie
aliases CVE-2020-5238
risk_score 3.0
exploitability 0.5
weighted_severity 5.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-brhv-976k-sbhe
6
url VCID-gkxf-yuu8-gyfg
vulnerability_id VCID-gkxf-yuu8-gyfg
summary cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-22485
reference_id
reference_type
scores
0
value 0.00071
scoring_system epss
scoring_elements 0.21809
published_at 2026-06-04T12:55:00Z
1
value 0.00071
scoring_system epss
scoring_elements 0.21891
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-22485
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22485
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22485
2
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033110
reference_id 1033110
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033110
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033111
reference_id 1033111
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033111
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033112
reference_id 1033112
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033112
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033113
reference_id 1033113
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033113
6
reference_url https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr
reference_id GHSA-c944-cv5f-hpvr
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-10T21:02:09Z/
url https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr
fixed_packages
0
url pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie
aliases CVE-2023-22485
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gkxf-yuu8-gyfg
7
url VCID-p384-h1h3-z7bt
vulnerability_id VCID-p384-h1h3-z7bt
summary cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-37463
reference_id
reference_type
scores
0
value 0.00221
scoring_system epss
scoring_elements 0.44819
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-37463
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37463
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37463
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041097
reference_id 1041097
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041097
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041098
reference_id 1041098
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041098
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041099
reference_id 1041099
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041099
6
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041100
reference_id 1041100
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041100
7
reference_url https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5
reference_id GHSA-w4qg-3vf7-m9x5
reference_type
scores
0
value 6.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-30T18:48:24Z/
url https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5
fixed_packages
0
url pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie
aliases CVE-2023-37463
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-p384-h1h3-z7bt
8
url VCID-ph5n-2d4n-mfd3
vulnerability_id VCID-ph5n-2d4n-mfd3
summary Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in commonmarker.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22051.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22051.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-22051
reference_id
reference_type
scores
0
value 0.12055
scoring_system epss
scoring_elements 0.93928
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-22051
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22051
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22051
3
reference_url https://github.com/gjtorikian/commonmarker
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/gjtorikian/commonmarker
4
reference_url https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-01-08T18:15:45Z/
url https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
5
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-22051
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-22051
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2256887
reference_id 2256887
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2256887
8
reference_url https://github.com/advisories/GHSA-fmx4-26r3-wxpf
reference_id GHSA-fmx4-26r3-wxpf
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-01-08T18:15:45Z/
url https://github.com/advisories/GHSA-fmx4-26r3-wxpf
9
reference_url https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
reference_id GHSA-fmx4-26r3-wxpf
reference_type
scores
0
value 9.8
scoring_system cvssv3
scoring_elements
1
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
4
value HIGH
scoring_system generic_textual
scoring_elements
5
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-01-08T18:15:45Z/
url https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
10
reference_url https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
reference_id GHSA-mc3g-88wq-6f4x
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-01-08T18:15:45Z/
url https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
fixed_packages
0
url pkg:deb/debian/ruby-commonmarker@0.23.4-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.4-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.4-1%3Fdistro=trixie
1
url pkg:deb/debian/ruby-commonmarker@0.23.6-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.6-1?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-22uj-nmkk-jbfr
1
vulnerability VCID-29sg-t6ye-2kbh
2
vulnerability VCID-4d5b-yhjq-7ka7
3
vulnerability VCID-7s8k-utv9-1qfs
4
vulnerability VCID-gkxf-yuu8-gyfg
5
vulnerability VCID-p384-h1h3-z7bt
6
vulnerability VCID-uqng-ft4x-3ydj
7
vulnerability VCID-uw1x-u1gn-2yd1
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.6-1%3Fdistro=trixie
2
url pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie
aliases CVE-2024-22051, GHSA-fmx4-26r3-wxpf, GMS-2022-240
risk_score 4.4
exploitability 0.5
weighted_severity 8.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ph5n-2d4n-mfd3
9
url VCID-uqng-ft4x-3ydj
vulnerability_id VCID-uqng-ft4x-3ydj
summary cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources. ### Impact A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. ### Proof of concept ``` $ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext ``` Increasing the number 10000 in the above commands causes the running time to increase quadratically. ### Patches This vulnerability have been patched in 0.29.0.gfm.10. ### Note on cmark and cmark-gfm XXX: TBD [cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`. ### Credit We would like to thank @gravypod for reporting this vulnerability. ### References https://en.wikipedia.org/wiki/Time_complexity ### For more information If you have any questions or comments about this advisory: * Open an issue in [github/cmark-gfm](https://github.com/github/cmark-gfm)
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-26485.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-26485.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-26485
reference_id
reference_type
scores
0
value 0.00154
scoring_system epss
scoring_elements 0.35965
published_at 2026-06-05T12:55:00Z
1
value 0.00154
scoring_system epss
scoring_elements 0.3587
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-26485
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26485
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26485
3
reference_url https://github.com/github/cmark-gfm/commit/07a66c9bc341f902878e37d7da8647d6ef150987
reference_id 07a66c9bc341f902878e37d7da8647d6ef150987
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-11T17:20:05Z/
url https://github.com/github/cmark-gfm/commit/07a66c9bc341f902878e37d7da8647d6ef150987
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034171
reference_id 1034171
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034171
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034172
reference_id 1034172
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034172
6
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034173
reference_id 1034173
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034173
7
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034174
reference_id 1034174
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034174
8
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2210173
reference_id 2210173
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2210173
9
reference_url https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5
reference_id GHSA-r8vr-c48j-fcc5
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-11T17:20:05Z/
url https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5
10
reference_url https://usn.ubuntu.com/7319-1/
reference_id USN-7319-1
reference_type
scores
url https://usn.ubuntu.com/7319-1/
fixed_packages
0
url pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie
aliases CVE-2023-26485
risk_score 3.4
exploitability 0.5
weighted_severity 6.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-uqng-ft4x-3ydj
10
url VCID-uw1x-u1gn-2yd1
vulnerability_id VCID-uw1x-u1gn-2yd1
summary cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-22486
reference_id
reference_type
scores
0
value 0.00122
scoring_system epss
scoring_elements 0.3079
published_at 2026-06-04T12:55:00Z
1
value 0.00122
scoring_system epss
scoring_elements 0.30862
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-22486
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22486
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22486
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033110
reference_id 1033110
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033110
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033111
reference_id 1033111
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033111
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033112
reference_id 1033112
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033112
6
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033113
reference_id 1033113
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033113
7
reference_url https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p
reference_id GHSA-r572-jvj2-3m8p
reference_type
scores
0
value 3.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-10T21:01:28Z/
url https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p
8
reference_url https://usn.ubuntu.com/7319-1/
reference_id USN-7319-1
reference_type
scores
url https://usn.ubuntu.com/7319-1/
fixed_packages
0
url pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
purl pkg:deb/debian/ruby-commonmarker@0.23.10-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie
aliases CVE-2023-22486
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-uw1x-u1gn-2yd1
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby-commonmarker@0.23.10-1%3Fdistro=trixie