CVE-2023-28626 MEDIUM

CVE-2023-28626: Quadratic runtime when parsing Markdown in comrak

Vendor Kivikakk
Product comrak
Weakness CWE-400
Published March 28, 2023
Last update February 18, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. This issue has been addressed in version 0.17.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-047`

Key dates

02Disclosure timeline

March 28, 2023 CVE published
February 18, 2025 Record updated