CVE-2023-22483 - CVE House
Back to Database
Status published Low CVE-2023-22483

cmark-gfm Quadratic complexity bugs may lead to a denial of service

Vulnerability Description

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0.29.0.gfm.7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-22483

Credits & Attribution

No credits recorded in the NVD database.

References

More from github

View All →
CVE-2025-24362
CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts
High 7.1
CVE-2024-25129
Limited data exfiltration in CodeQL CLI
Low 2.7
CVE-2023-37463
Quadratic complexity bugs may lead to a denial of service
Medium 6.4
CVE-2023-26485
Quadratic complexity may lead to a denial of service in cmark-gfm
Medium 5.3
CVE-2023-24824
Quadratic complexity may lead to a denial of service in cmark-gfm
Medium 5.3

Affected Vendor

Affected Software

cmark-gfm
Vulnerable Versions:
< 0.29.0.gfm.7

Timeline

Official Publish: January 23rd, 2023
Last Modified: March 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact