GMS-2023-123: Several quadratic complexity bugs may lead to denial of service in Commonmarker

January 24, 2023

Impact

Several quadratic complexity bugs in commonmarker’s underlying cmark-gfm library may lead to unbounded resource exhaustion and subsequent denial of service.

The following vulnerabilities were addressed:

CVE-2023-22483
CVE-2023-22484
CVE-2023-22485
CVE-2023-22486

For more information, consult the release notes for version 0.23.0.gfm.7.

Mitigation

Users are advised to upgrade to commonmarker version 0.23.7.

References

github.com/advisories/GHSA-636f-xm5j-pj9m
github.com/gjtorikian/commonmarker/security/advisories/GHSA-636f-xm5j-pj9m

Code Behaviors & Features

Detect and mitigate GMS-2023-123 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →