CVE-2023-28626

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-28626
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-28626.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-28626
Aliases
Related
Published
2023-03-28T21:15:11Z
Modified
2025-01-08T14:52:12.893500Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. This issue has been addressed in version 0.17.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GHSL-2023-047

References

Affected packages

Git / github.com/kivikakk/comrak

Affected ranges

Type
GIT
Repo
https://github.com/kivikakk/comrak
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed

Affected versions

0.*

0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.10.0
0.10.1
0.10.1-rc.1
0.11.0
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.14.0
0.15.0
0.16.0
0.2.0
0.2.1
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.3.0
0.3.1
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1