CVE-2023-24824 - CVE House
Back to Database
Status published Medium CVE-2023-24824

Quadratic complexity may lead to a denial of service in cmark-gfm

Vulnerability Description

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-24824

Credits & Attribution

No credits recorded in the NVD database.

References

More from github

View All →
CVE-2025-24362
CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts
High 7.1
CVE-2024-25129
Limited data exfiltration in CodeQL CLI
Low 2.7
CVE-2023-37463
Quadratic complexity bugs may lead to a denial of service
Medium 6.4
CVE-2023-26485
Quadratic complexity may lead to a denial of service in cmark-gfm
Medium 5.3
CVE-2023-22486
cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of service
Low 3.5

Affected Vendor

Affected Software

cmark-gfm
Vulnerable Versions:
< 0.29.0.gfm.10

Timeline

Official Publish: March 31st, 2023
Last Modified: February 11th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-400 CWE-407

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact