Quadratic complexity may lead to a denial of service in cmark-gfm

CVE-2023-26485

What is CVE-2023-26485?

A polynomial time complexity vulnerability in cmark-gfm, GitHub's fork of the cmark library, can result in unbounded resource exhaustion and denial of service. The issue arises during the parsing of text that contains a large number of underscore characters, leading to quadratic increases in processing time. Affected users are urged to upgrade to version 0.29.0.gfm.10 to mitigate this risk, and those who cannot upgrade should ensure their input sources are trusted.

References