# CVE-2023-26485: cmark-gfm: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and renderinglibrary and program in C

CVE-2023-26485 is fixed in 10 products on 1 platform, first by cmark-gfm 0.29.0.gfm.0-4ubuntu0.1~esm1, released March 31, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-26485
- Priority: High
- CVSS: 7.5 (Medium)
- EPSS: 0.0103
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 31, 2023

## Description

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and renderinglibrary and program in C. A polynomial time complexity issue in cmark-gfmmay lead to unbounded resource exhaustion and subsequent denial of service.This CVE covers quadratic complexity issues when parsing text which leadswith either large numbers of `_` characters. This issue has been addressedin version 0.29.0.gfm.10. Users are advised to upgrade. Users unable toupgrade should validate that their input comes from trusted sources.### ImpactA polynomial time complexity issue in cmark-gfm may lead to unboundedresource exhaustion and subsequent denial of service.### Proof of concept```$ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad,end="")' | time ./build/src/cmark-gfm --to plaintext```Increasing the number 10000 in the above commands causes the running timeto increase quadratically.### PatchesThis vulnerability have been patched in 0.29.0.gfm.10.### Note on cmark and cmark-gfmXXX: TBD[cmark-gfm](https://github.com/github/cmark-gfm) is a fork of[cmark](https://github.com/commonmark/cmark) that adds the GitHub FlavoredMarkdown extensions. The two codebases have diverged over time, but share acommon core. These bugs affect both `cmark` and `cmark-gfm`.### CreditWe would like to thank @gravypod for reporting this vulnerability.### Referenceshttps://en.wikipedia.org/wiki/Time_complexity### For more informationIf you have any questions or comments about this advisory:* Open an issue in [github/cmark-gfm](https://github.com/github/cmark-gfm)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | cmark-gfm Debian 13.5 (trixie) | 0.29.0.gfm.13-1 | [DEBIAN-CVE-2023-26485](https://patchblox.com/security/data/fix/linux/debian-cve-2023-26485.md) | Mar 31, 2023 |
| Linux | cmark-gfm Debian 14 | 0.29.0.gfm.13-1 | [DEBIAN-CVE-2023-26485](https://patchblox.com/security/data/fix/linux/debian-cve-2023-26485.md) | Mar 31, 2023 |
| Linux | cmark-gfm Ubuntu 20.04 LTS (focal) | 0.29.0.gfm.0-4ubuntu0.1~esm1 | [cmark-gfm 0.29.0.gfm.0-4ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-cmark-gfm-0.29.0.gfm.0-4ubuntu0.1-esm1.md) | Mar 31, 2023 |
| Linux | cmark-gfm Ubuntu 22.04.1 LTS (jammy) | 0.29.0.gfm.3-3ubuntu0.1~esm1 | [cmark-gfm 0.29.0.gfm.3-3ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-cmark-gfm-0.29.0.gfm.3-3ubuntu0.1-esm1.md) | Mar 31, 2023 |
| Linux | cmark-gfm Ubuntu 24.04.5 LTS (noble) | 0.29.0.gfm.6-6ubuntu0.24.04.1~esm1 | [cmark-gfm 0.29.0.gfm.6-6ubuntu0.24.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-cmark-gfm-0.29.0.gfm.6-6ubuntu0.24.04.1-esm1.md) | Mar 31, 2023 |
| Linux | cmark-gfm Ubuntu 24.10 (oracular) | 0.29.0.gfm.6-6ubuntu0.24.10.1 | [cmark-gfm 0.29.0.gfm.6-6ubuntu0.24.10.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-cmark-gfm-0.29.0.gfm.6-6ubuntu0.24.10.1.md) | Jan 16, 2026 |
| Linux | libcmark-gfm-extensions0 Ubuntu 20.04 LTS (focal) | 0.29.0.gfm.0-4ubuntu0.1~esm1 | [libcmark-gfm-extensions0 0.29.0.gfm.0-4ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libcmark-gfm-extensions0-0.29.0.gfm.0-4ubuntu0.1-esm1.md) | Mar 31, 2023 |
| Linux | libcmark-gfm-extensions0.29.0.gfm.3 Ubuntu 22.04.1 LTS (jammy) | 0.29.0.gfm.3-3ubuntu0.1~esm1 | [libcmark-gfm-extensions0.29.0.gfm.3 0.29.0.gfm.3-3ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libcmark-gfm-extensions0.29.0.gfm.3-0.29.0.gfm.3-3ubuntu0.1-esm1.md) | Mar 31, 2023 |
| Linux | libcmark-gfm-extensions0.29.0.gfm.6 Ubuntu 24.04.5 LTS (noble) | 0.29.0.gfm.6-6ubuntu0.24.04.1~esm1 | [libcmark-gfm-extensions0.29.0.gfm.6 0.29.0.gfm.6-6ubuntu0.24.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libcmark-gfm-extensions0.29.0.gfm.6-0.29.0.gfm.6-6ubuntu0.24.04.1-esm1.md) | Mar 31, 2023 |
| Linux | libcmark-gfm-extensions0.29.0.gfm.6 Ubuntu 24.10 (oracular) | 0.29.0.gfm.6-6ubuntu0.24.10.1 | [libcmark-gfm-extensions0.29.0.gfm.6 0.29.0.gfm.6-6ubuntu0.24.10.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libcmark-gfm-extensions0.29.0.gfm.6-0.29.0.gfm.6-6ubuntu0.24.10.1.md) | Jan 16, 2026 |
| Linux | libcmark-gfm0 Ubuntu 20.04 LTS (focal) | 0.29.0.gfm.0-4ubuntu0.1~esm1 | [libcmark-gfm0 0.29.0.gfm.0-4ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libcmark-gfm0-0.29.0.gfm.0-4ubuntu0.1-esm1.md) | Mar 31, 2023 |
| Linux | libcmark-gfm0.29.0.gfm.3 Ubuntu 22.04.1 LTS (jammy) | 0.29.0.gfm.3-3ubuntu0.1~esm1 | [libcmark-gfm0.29.0.gfm.3 0.29.0.gfm.3-3ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libcmark-gfm0.29.0.gfm.3-0.29.0.gfm.3-3ubuntu0.1-esm1.md) | Mar 31, 2023 |
| Linux | libcmark-gfm0.29.0.gfm.6 Ubuntu 24.04.5 LTS (noble) | 0.29.0.gfm.6-6ubuntu0.24.04.1~esm1 | [libcmark-gfm0.29.0.gfm.6 0.29.0.gfm.6-6ubuntu0.24.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libcmark-gfm0.29.0.gfm.6-0.29.0.gfm.6-6ubuntu0.24.04.1-esm1.md) | Mar 31, 2023 |
| Linux | libcmark-gfm0.29.0.gfm.6 Ubuntu 24.10 (oracular) | 0.29.0.gfm.6-6ubuntu0.24.10.1 | [libcmark-gfm0.29.0.gfm.6 0.29.0.gfm.6-6ubuntu0.24.10.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libcmark-gfm0.29.0.gfm.6-0.29.0.gfm.6-6ubuntu0.24.10.1.md) | Jan 16, 2026 |
| Linux | python-cmarkgfm Debian 13.5 (trixie) | 2024.11.20-1 | [DEBIAN-CVE-2023-26485](https://patchblox.com/security/data/fix/linux/debian-cve-2023-26485.md) | Mar 31, 2023 |
| Linux | python-cmarkgfm Debian 14 | 2024.11.20-1 | [DEBIAN-CVE-2023-26485](https://patchblox.com/security/data/fix/linux/debian-cve-2023-26485.md) | Mar 31, 2023 |
| Linux | r-cran-commonmark Debian 13.5 (trixie) | 1.9.1-1 | [DEBIAN-CVE-2023-26485](https://patchblox.com/security/data/fix/linux/debian-cve-2023-26485.md) | Mar 31, 2023 |
| Linux | r-cran-commonmark Debian 14 | 1.9.1-1 | [DEBIAN-CVE-2023-26485](https://patchblox.com/security/data/fix/linux/debian-cve-2023-26485.md) | Mar 31, 2023 |
| Linux | ruby-commonmarker Debian 13.5 (trixie) | 0.23.10-1 | [DEBIAN-CVE-2023-26485](https://patchblox.com/security/data/fix/linux/debian-cve-2023-26485.md) | Mar 31, 2023 |
| Linux | ruby-commonmarker Debian 14 | 0.23.10-1 | [DEBIAN-CVE-2023-26485](https://patchblox.com/security/data/fix/linux/debian-cve-2023-26485.md) | Mar 31, 2023 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.