Skip to content

Several quadratic complexity bugs may lead to denial of service in Commonmarker

Moderate
gjtorikian published GHSA-636f-xm5j-pj9m Jan 24, 2023

Package

bundler commonmarker (RubyGems)

Affected versions

< 0.23.7

Patched versions

0.23.7

Description

Impact

Several quadratic complexity bugs in commonmarker's underlying cmark-gfm library may lead to unbounded resource exhaustion and subsequent denial of service.

The following vulnerabilities were addressed:

For more information, consult the release notes for version 0.23.0.gfm.7.

Mitigation

Users are advised to upgrade to commonmarker version 0.23.7.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

No CWEs