CVE-2022-39209: Uncontrolled Resource Consumption in cmark-gfm
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running python3 -c 'print("![l" 100000 + "\n")' | ./cmark-gfm -e autolink, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-39209?
CVE-2022-39209 is a vulnerability in cmark-gfm, GitHub's fork of cmark, which could lead to unbounded resource exhaustion and denial of service.
What is the severity of CVE-2022-39209?
The severity of CVE-2022-39209 is high with a severity score of 6.5.
How does CVE-2022-39209 affect cmark-gfm?
CVE-2022-39209 affects cmark-gfm versions prior to 0.29.0.gfm.6 and may lead to unbounded resource exhaustion and subsequent denial of service.
How can I verify if my version of cmark-gfm is affected by CVE-2022-39209?
You can verify if your version of cmark-gfm is affected by CVE-2022-39209 by checking the patch version. Versions prior to 0.29.0.gfm.6 are affected.
How can I fix CVE-2022-39209?
To fix CVE-2022-39209, you should update cmark-gfm to version 0.29.0.gfm.6 or newer.