Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-r3h9-dpmf-sfdq
Vulnerability ID VCID-r3h9-dpmf-sfdq
Aliases CVE-2023-24824
Summary cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-400 Uncontrolled Resource Consumption
CWE-407 Inefficient Algorithmic Complexity
CWE-1286 Improper Validation of Syntactic Correctness of Input
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-24824.json
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2023-24824
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2023-24824
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2023-24824
epss 0.00319 https://api.first.org/data/v1/epss?cve=CVE-2023-24824
cvssv3.1 5.3 https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
ssvc Track https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
cvssv3.1 5.3 https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
ssvc Track https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-24824.json
https://api.first.org/data/v1/epss?cve=CVE-2023-24824
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24824
1034171 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034171
1034172 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034172
1034173 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034173
1034174 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034174
2210172 https://bugzilla.redhat.com/show_bug.cgi?id=2210172
2300c1bd2c8226108885bf019655c4159cf26b59 https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
GHSA-66g8-4hjf-77xh https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
RHSA-2025:8427 https://access.redhat.com/errata/RHSA-2025:8427
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-24824.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-11T17:19:34Z/ Found at https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-11T17:19:34Z/ Found at https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
Exploit Prediction Scoring System (EPSS)
Percentile 0.49167
EPSS Score 0.00254
Published At June 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:29:04.723301+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/24xxx/CVE-2023-24824.json 38.6.0