https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T17:55:28.310207+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2022-39209 CVE-2022-39209 — Uncontrolled Resource Consumption in cmark-gfm 2026-09-29T17:55:28.311908+00:00

Affected: github cmark-gfm

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.

 https://vulnerability.circl.lu/vuln/usn-7319-1 USN-7319-1 — cmark-gfm vulnerabilities 2026-09-29T17:55:28.312020+00:00

Affected: Ubuntu:Pro:20.04:LTS: cmark-gfm, Ubuntu:Pro:22.04:LTS: cmark-gfm, Ubuntu:Pro:24.04:LTS: cmark-gfm

It was discovered that cmark-gfm's autolink extension did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-39209)

It was discovered that cmark-gfm did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2023-22483)

It was discovered that cmark-gfm did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2023-22484)

It was discovered that cmark-gfm did not correctly handle parsing large inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-22486, CVE-2023-26485)