CVE-2022-39209
Uncontrolled Resource Consumption in cmark-gfm
- State
- Published
- Severity
- 7.5 High
- Published
- Sep 15, 2022
- Updated
- Apr 23, 2025
- Reserved
- Sep 2, 2022
Description
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | GitHub_M |
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
cmark-gfmgithub |
|
References
- https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q
- https://github.com/github/cmark-gfm/commit/9d57d8a23142b316282bdfc954cb0ecda40a8655
- https://en.wikipedia.org/wiki/Time_complexity
- FEDORA-2022-6bcee2cc93vendor-advisory
- FEDORA-2022-f1aed93db8vendor-advisory
- FEDORA-2022-dc6d6d9d6cvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.