Quadratic complexity may lead to a denial of service in cmark-gfm

CVE-2023-24824

Summary

The cmark-gfm library, a variant of the C CommonMark parsing and rendering tool, contains a vulnerability that can result in unbounded resource exhaustion. This occurs when processing inputs with a high density of specific characters, such as consecutive > or -, leading to potential denial of service. To mitigate risks, users should upgrade to version 0.29.0.gfm.10 or later. If upgrading is not feasible, it is crucial to ensure that input data is sourced from trusted entities to avoid exploitation.

References