What is the CVSS score of CVE-2023-26485?

CVE-2023-26485 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.0%.

Is there a public PoC exploit available for CVE-2023-26485?

Yes, a public proof-of-concept exploit is available for CVE-2023-26485. Prioritise patching immediately. EPSS: 1.0%.

Is there a patch available for CVE-2023-26485?

Yes, a patch is available for CVE-2023-26485. Update the affected software to the latest version immediately.

Github CVE-2023-26485

HIGH

Uncontrolled Resource Consumption (CWE-400)

2023-03-31 security-advisories@github.com

Denial Of Service Github Cmark Gfm

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Mar 31, 2023 - 23:15 nvd

HIGH 7.5

DescriptionNVD

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of _ characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.

Impact

A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.

Proof of concept

$ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext

Increasing the number 10000 in the above commands causes the running time to increase quadratically.

Patches

This vulnerability have been patched in 0.29.0.gfm.10.

Note on cmark and cmark-gfm

XXX: TBD

cmark-gfm is a fork of cmark that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both cmark and cmark-gfm.

Credit

We would like to thank @gravypod for reporting this vulnerability.

References

https://en.wikipedia.org/wiki/Time_complexity

For more information

If you have any questions or comments about this advisory:

Open an issue in github/cmark-gfm

AnalysisAI

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which allows attackers to cause denial of service by exhausting system resources. cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of _ characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.

Impact A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.

Proof of concept ` $ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext ` Increasing the number 10000 in the above commands causes the running time to increase quadratically.

Patches This vulnerability have been patched in 0.29.0.gfm.10.

Note on cmark and cmark-gfm XXX: TBD cmark-gfm is a fork of cmark that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`.

Credit We would like to thank @gravypod for reporting this vulnerability.

References https://en.wikipedia.org/wiki/Time_complexity

For more information If you have any questions or comments about this advisory: * Open an issue in github/cmark-gfm Affected products include: Github Cmark-Gfm. Version information: version 0.29.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement rate limiting, set resource quotas, validate input sizes, use timeouts.

More in Github

View all

CVE-2026-1699 CRITICAL Act Now POC

10.0 Jan 30

Supply chain vulnerability in Eclipse Theia GitHub Actions workflow. The preview.yml workflow uses pull_request_target w

CVE-2026-27941 CRITICAL Act Now POC

9.9 Feb 26

Supply chain attack vector in OpenLIT GitHub Actions workflows. The pull_request_target trigger with checkout enables ma

CVE-2026-22869 CRITICAL Act Now POC

9.8 Jan 13

Eigent multi-agent workflow CI pipeline (ci.yml) uses pull_request_target with checkout of untrusted PR code, enabling a

CVE-2024-0200 CRITICAL Act Now POC

9.8 Jan 16

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. R

CVE-2022-24724 CRITICAL Act Now POC

9.8 Mar 03

cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Rated critical severity (CVSS 9.

CVE-2024-9487 CRITICAL Act Now POC

9.5 Oct 10

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowe

CVE-2026-28215 CRITICAL Act Now POC

9.1 Feb 26

Unauthenticated infrastructure overwrite in Hoppscotch API development ecosystem before 2026.2.0. Attackers can overwrit

CVE-2018-1000600 HIGH This Week POC

8.8 Jun 26

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCrede

CVE-2026-30920 HIGH This Week POC

8.6 Mar 10

OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by

CVE-2026-25221 HIGH This Week POC

8.1 Feb 02

PolarLearn versions 0-PRERELEASE-15 and earlier lack proper state parameter validation in OAuth 2.0 authentication, enab

CVE-2026-23644 HIGH This Week POC

7.5 Jan 18

Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers

CVE-2024-42471 HIGH This Week POC

7.5 Sep 02

actions/artifact is the GitHub ToolKit for developing GitHub Actions. Rated high severity (CVSS 7.5), this vulnerability

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all

CVE-2023-44487 HIGH POC

7.5

CVE-2026-45498 HIGH POC

7.5

CVE-2016-8610 HIGH

7.5

CVE-2026-28318 HIGH POC

7.5

7.5

7.5

7.5

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

CVE-2023-26485 vulnerability details – vuln.today

Back

Github CVE-2023-26485

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

Impact

Proof of concept

Patches

Note on cmark and cmark-gfm

Credit

References

For more information

AnalysisAI

Technical ContextAI

Impact A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.

Proof of concept ` $ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext ` Increasing the number 10000 in the above commands causes the running time to increase quadratically.

Patches This vulnerability have been patched in 0.29.0.gfm.10.

Note on cmark and cmark-gfm XXX: TBD cmark-gfm is a fork of cmark that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both cmark and cmark-gfm.

Credit We would like to thank @gravypod for reporting this vulnerability.

References https://en.wikipedia.org/wiki/Time_complexity

For more information If you have any questions or comments about this advisory: * Open an issue in github/cmark-gfm Affected products include: Github Cmark-Gfm. Version information: version 0.29.0..

RemediationAI

More in Github

Same weakness CWE-400 – Uncontrolled Resource Consumption

Same technique Denial Of Service

Share

External POC / Exploit Code

Note on cmark and cmark-gfm XXX: TBD cmark-gfm is a fork of cmark that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`.