CVE-2023-28626

comrak project comrak

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2023-28626

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Uncontrolled Resource Consumption pada comrak project comrak. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. This issue has been addressed in version 0.17.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-047`

Rincian

Terbit di NVD
28 Maret 2023
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-400: Uncontrolled Resource Consumption
EPSS (30 hari)
1,1% peluang dieksploitasi; lebih tinggi dari 65,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
comrak project comrak Semua versi sebelum 0.17.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.