摘要:
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.
### Impact
A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.
### Proof of concept
```
$ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext
```
Increasing the number 10000 in the above commands causes the running time to increase quadratically.
### Patches
This vulnerability have been patched in 0.29.0.gfm.10.
### Note on cmark and cmark-gfm
XXX: TBD
[cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`.
### Credit
We would like to thank @gravypod for reporting this vulnerability.
### References
https://en.wikipedia.org/wiki/Time_complexity
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github/cmark-gfm](https://github.com/github/cmark-gfm)
安全等级: Low
公告ID: KylinSec-SA-2025-2416
发布日期: 2025年5月30日
关联CVE: CVE-2023-26485
cmark-gfm 是 GitHub 对 cmark 的分叉，后者是一个用 C 语言编写的 CommonMark 解析与渲染库及程序。cmark-gfm 中存在多项式时间复杂度问题，可能导致无限制的资源耗尽并引发拒绝服务攻击。此 CVE 涉及解析以大量下划线（_）字符开头的文本时产生的二次复杂度问题。该问题已在版本 0.29.0.gfm.10 中修复。建议用户升级。若无法升级，请确保输入内容来自可信来源。
影响
cmark-gfm 中的多项式时间复杂度问题可能导致资源无限消耗，进而引发拒绝服务攻击。
概念验证
$ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext
在上述命令中，将 10000 替换为更大的数值会导致运行时间呈二次方增长。
补丁
此漏洞已在 0.29.0.gfm.10 版本中修复。
关于 cmark 和 cmark-gfm 的说明
XXX: 待补充
cmark-gfm 是 cmark 的分叉版本，增加了 GitHub Flavored Markdown 扩展功能。两者代码库已逐步分离，但仍共享核心部分。此漏洞同时影响 cmark 和 cmark-gfm。
致谢
感谢 @gravypod 报告此漏洞。
其他信息
若您对此公告有疑问或意见：
在 github/cmark-gfm 中提交问题。
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2023-26485 | KY3.4-5A | python-cmarkgfm | Unaffected |
| CVE-2023-26485 | V6 | python-cmarkgfm | Unaffected |
