CVE-2022-39209CWE-400

Uncontrolled Resource Consumption in cmark-gfm

High · published September 15, 2022

CVSS v3.1
7.5
EPSS
2%
Percentile
82.0
In the wild
Unconfirmed
What it is

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02151 · 82.0th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2022-09-15T00:00Z
EPSS history
Timeline
  • 15 SEP 00:00Z
    Uncontrolled Resource Consumption in cmark-gfm
    cvelistv5