CVE-2022-39209

github cmark-gfm, fedoraproject fedora

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-39209

Katalog CVE

CVSS 6.5 · Medium EPSS 2,2%

Kerentanan Uncontrolled Resource Consumption pada github cmark-gfm, fedoraproject fedora. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.

Rincian

Terbit di NVD
15 September 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-400: Uncontrolled Resource Consumption
CWE-407: Inefficient Algorithmic Complexity
EPSS (30 hari)
2,2% peluang dieksploitasi; lebih tinggi dari 81,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
github cmark-gfm Semua versi sebelum 0.29.0.gfm.6
fedoraproject fedora Versi 35
fedoraproject fedora Versi 36
fedoraproject fedora Versi 37

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.