CVE-2023-37463

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
githubcmark-gfm< 0.29.0.gfm.12

References

Timeline

Published
Jul 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-374647.5OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly usCVE-2023-3746610.0vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenaCVE-2023-374675.4Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content SecuCVE-2023-374685.5Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored CVE-2023-374698.8CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connecCVE-2023-37475.5Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created byCVE-2023-374709.8Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3,CVE-2023-374719.8Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements CVE-2023-374726.5Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without prior sanCVE-2023-374738.8zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused thCVE-2023-374747.5Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder.CVE-2023-374757.5Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to