CVE-2023-37463
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
cmark-gfm is an extended version of the C reference implementation of CommonMark, which has three polynomial time complexity issues. These issues may lead to unbounded resource exhaustion and subsequent denial of service.
Risk Assessment
Exploitation of these vulnerabilities could lead to significant service disruptions, impacting application availability and user trust.
Recommendation
It is recommended to upgrade to version 0.29.0.gfm.12, where these vulnerabilities have been patched.
Original NVD description (English source)
cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.