Back to Database
Status published
Medium
CVE-2020-5238
Denial of service in table parsing in cmark-gfm
Vulnerability Description
The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5238
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5-hc85
- https://github.com/github/cmark-gfm/commit/85d895289c5ab67f988ca659493a64abb5fec7b4
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCDHBTUFIOYRIS5HAS6PZNBNMB7IOAX3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGJH2A4VAV54X6NSCNNGSEIGIIY5N2VR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMQFOQQCWOAMQ4I2XIVCVOXXIJ75HDCW/
More from github
View All →CVE-2025-24362
CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts
High
7.1
CVE-2024-25129
Limited data exfiltration in CodeQL CLI
Low
2.7
CVE-2023-37463
Quadratic complexity bugs may lead to a denial of service
Medium
6.4
CVE-2023-26485
Quadratic complexity may lead to a denial of service in cmark-gfm
Medium
5.3
CVE-2023-24824
Quadratic complexity may lead to a denial of service in cmark-gfm
Medium
5.3
Affected Vendor
github
View all reports →Affected Software
cmark-gfm
Vulnerable Versions:
< 0.29.0.gfm.1
Timeline
Official Publish:
July 1st, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H