Back to Database
Status published
Low
CVE-2023-22486
cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of service
Vulnerability Description
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-22486
Credits & Attribution
No credits recorded in the NVD database.
More from github
View All →CVE-2025-24362
CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts
High
7.1
CVE-2024-25129
Limited data exfiltration in CodeQL CLI
Low
2.7
CVE-2023-37463
Quadratic complexity bugs may lead to a denial of service
Medium
6.4
CVE-2023-26485
Quadratic complexity may lead to a denial of service in cmark-gfm
Medium
5.3
CVE-2023-24824
Quadratic complexity may lead to a denial of service in cmark-gfm
Medium
5.3
Affected Vendor
github
View all reports →Affected Software
cmark-gfm
Vulnerable Versions:
< 0.29.0.gfm.7
Timeline
Official Publish:
January 24th, 2023
Last Modified:
March 10th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L