HSEC-2025-0007
NoneCVSS
—
EPSS
—
Published
Dec 27, 2025
CISA due date
—
The record
cmark-gfm: resource exhaustion due to quadratic complexity in parser
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | cmark-gfm | 0 | No fix |
| Debian:11 | python-cmarkgfm | 0 | No fix |
| Debian:11 | r-cran-commonmark | 0 | No fix |
| Debian:11 | ruby-commonmarker | 0 | No fix |
| Debian:12 | cmark-gfm | 0 | No fix |
| Debian:12 | python-cmarkgfm | 0 | No fix |
| Debian:12 | r-cran-commonmark | 0 | No fix |
| Debian:12 | ruby-commonmarker | 0 | No fix |
| Debian:13 | cmark-gfm | 0 | No fix |
| Debian:13 | python-cmarkgfm | 0 | No fix |
| Debian:13 | r-cran-commonmark | 0 | No fix |
| Debian:13 | ruby-commonmarker | 0 | No fix |
| Hackage | cmark-gfm | 0.1.0 | 0.2.6 |
| Ubuntu:20.04:LTS | cmark | 0 | No fix |
| Ubuntu:20.04:LTS | cmark-gfm | 0 | No fix |
| Ubuntu:22.04:LTS | cmark | 0 | No fix |
| Ubuntu:22.04:LTS | cmark-gfm | 0 | No fix |
| Ubuntu:24.04:LTS | cmark | 0 | No fix |
| Ubuntu:24.04:LTS | cmark-gfm | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | cmark | 0 | No fix |