CVE-2022-39209: Uncontrolled Resource Consumption in cmark-gfm
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running python3 -c 'print("![l" 100000 + "\n")' | ./cmark-gfm -e autolink, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cmark-gfmto a version that resolves this vulnerability.Fixed in 0.29.0.gfm.6-6Fixed in 0.29.0.gfm.13-4Fixed in 0.29.0.gfm.13-7.1 - Upgrade
Upgrade
debian/ghostwriterto a version that resolves this vulnerability.Fixed in 2.1.6+ds-2Fixed in 25.04.0+ds-1Fixed in 26.04.0+ds-1 - Upgrade
Upgrade
debian/python-cmarkgfmto a version that resolves this vulnerability.Fixed in 2024.11.20-1Fixed in 2025.10.22-2 - Upgrade
Upgrade
debian/r-cran-commonmarkto a version that resolves this vulnerability.Fixed in 1.8.1-1Fixed in 1.9.5-1Fixed in 2.0.0-3 - Upgrade
Upgrade
debian/ruby-commonmarkerto a version that resolves this vulnerability.Fixed in 0.23.10-1Fixed in 2.10.1-1 - Upgrade
Upgrade
debian/cmark-gfmto a version that resolves this vulnerability.Fixed in 0.29.0.gfm.6-2 - Upgrade
Upgrade
debian/ghostwriterto a version that resolves this vulnerability.Fixed in 2.1.6+ds-1 - Upgrade
Upgrade
debian/python-cmarkgfmto a version that resolves this vulnerability.Fixed in 2024.11.20-1 - Upgrade
Upgrade
debian/r-cran-commonmarkto a version that resolves this vulnerability.Fixed in 1.8.1-1 - Upgrade
Upgrade
debian/ruby-commonmarkerto a version that resolves this vulnerability.Fixed in 0.23.10-1 - Upgrade
Upgrade
cmark-gfmto a version that resolves this vulnerability.Fixed in 0.29.0.gfm.6 - Configuration
Disable use of the autolink extension if unable to upgrade.
cmark-gfm autolink extension = disabled
Event History
Frequently Asked Questions
What is CVE-2022-39209?
CVE-2022-39209 is a vulnerability in cmark-gfm, GitHub's fork of cmark, which could lead to unbounded resource exhaustion and denial of service.
What is the severity of CVE-2022-39209?
The severity of CVE-2022-39209 is high with a severity score of 6.5.
How does CVE-2022-39209 affect cmark-gfm?
CVE-2022-39209 affects cmark-gfm versions prior to 0.29.0.gfm.6 and may lead to unbounded resource exhaustion and subsequent denial of service.
How can I verify if my version of cmark-gfm is affected by CVE-2022-39209?
You can verify if your version of cmark-gfm is affected by CVE-2022-39209 by checking the patch version. Versions prior to 0.29.0.gfm.6 are affected.
How can I fix CVE-2022-39209?
To fix CVE-2022-39209, you should update cmark-gfm to version 0.29.0.gfm.6 or newer.