PT-2023-19806 · Cmark-Gfm+5 · Cmark-Gfm+5

Nwellnhof · Published 2023-03-31 · Updated 2025-12-27 · CVE-2023-24824

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions cmark-gfm versions prior to 0.29.0.gfm.10

Description A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This issue is related to quadratic complexity when parsing text that leads with either large numbers of > or - characters.

Recommendations For versions prior to 0.29.0.gfm.10, upgrade to version 0.29.0.gfm.10 or later to address the issue. For users unable to upgrade, validate that their input comes from trusted sources to minimize the risk of exploitation.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-407

CWE-400

Related Identifiers

ALSA-2025:8427

CESA-2025_8427

CVE-2023-24824

GHSA-66G8-4HJF-77XH

HSEC-2025-0007

INFSA-2025_8427

RHSA-2025:8427

RHSA-2025_8427

RSEC-2023-8

Affected Products

Almalinux

Centos

Debian

Red Hat

Rocky Linux

Cmark-Gfm

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24824.json · Exploit
• 🔥 https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh · Exploit
• https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59 · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-24824 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22485 · Vendor Advisory
• https://osv.dev/vulnerability/HSEC-2025-0007 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2025-8427.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24824 · Security Note
• https://osv.dev/vulnerability/ALSA-2025:8427 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-24824 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-24824 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-24824 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-26485 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-24824 · Vendor Advisory
• https://osv.dev/vulnerability/RSEC-2023-8 · Vendor Advisory