Medium severity6.4NVD Advisory· Published Jul 13, 2023· Updated Jun 17, 2026

CVE-2023-37463

Description

cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

GitHub/Cmark Gfmllm-fuzzy2 versions
>=0.29.0.gfm.12+ 1 more
- (no CPE)range: >=0.29.0.gfm.12
- (no CPE)range: < 0.29.0.gfm.12
osv-coords4 versions
pkg:deb/ubuntu/cmark-gfm@0.29.0.gfm.0-4?arch=source&distro=focal pkg:deb/ubuntu/cmark-gfm@0.29.0.gfm.3-3?arch=source&distro=jammy pkg:deb/ubuntu/cmark-gfm@0.29.0.gfm.6-6build1?arch=source&distro=noble pkg:deb/ubuntu/cmark-gfm@0.29.0.gfm.6-6build1?arch=source&distro=oracular
>= 0+ 3 more
- (no CPE)range: >= 0
- (no CPE)range: >= 0
- (no CPE)range: >= 0
- (no CPE)range: >= 0

Patches

Vulnerability mechanics

References

github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5nvdExploit
github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000