CVE-2023-24824

A flaw was found in CommonMarker. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.

This vulnerability can cause a potential denial of service (DoS) issue, but it can be classified as Moderate rather than Important due to a few key factors. First, the vulnerability specifically targets input with large numbers of specific characters (> or -), which means it is highly context-dependent and unlikely to be triggered by typical use cases. In practice, the majority of markdown documents are unlikely to contain these patterns in excessive quantities. Furthermore, the issue requires input from untrusted or malicious sources to be exploited, as normal, well-formed markdown documents will not trigger the problem.

While the quadratic time complexity can lead to significant resource exhaustion under certain conditions, it does not inherently enable arbitrary code execution or direct access to sensitive system resources.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.