CVE-2023-28626CWE-400

Quadratic runtime when parsing Markdown in comrak

Medium · published March 28, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
65.9
In the wild
Unconfirmed
What it is

comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. This issue has been addressed in version 0.17.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-047`

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01120 · 65.9th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2023-03-28T20:14Z
EPSS history
Timeline
  • 28 MAR 20:14Z
    Quadratic runtime when parsing Markdown in comrak
    cvelistv5