Back to Database
Status published
Medium
CVE-2023-37463
Quadratic complexity bugs may lead to a denial of service
Vulnerability Description
cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-37463
Credits & Attribution
No credits recorded in the NVD database.
References
More from github
View All →CVE-2025-24362
CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts
High
7.1
CVE-2024-25129
Limited data exfiltration in CodeQL CLI
Low
2.7
CVE-2023-26485
Quadratic complexity may lead to a denial of service in cmark-gfm
Medium
5.3
CVE-2023-24824
Quadratic complexity may lead to a denial of service in cmark-gfm
Medium
5.3
CVE-2023-22486
cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of service
Low
3.5
Affected Vendor
github
View all reports →Affected Software
cmark-gfm
Vulnerable Versions:
< 0.29.0.gfm.12
Timeline
Official Publish:
July 13th, 2023
Last Modified:
October 30th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H