CVE-2022-39209Uncontrolled Resource Consumption in cmark-gfm

7.5HighCVSS base score
2.3%Exploitation in 30 daysEPSS · top 16% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.

Timeline

2022
2 Sept 2022
2 Sept 2022
ID reserved
By GitHub_M
15 Sept 202213 days later
15 Sept 2022· 13 days later
Published
2025
23 Apr 20253 years later
23 Apr 2025· 3 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-39209, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Modified	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 2.3% · top 16% of all CVEs (15 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Affected products

github · cmark-gfm
- affected < 0.29.0.gfm.6

References6

https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q (opens in a new tab)x_transferred
https://github.com/github/cmark-gfm/commit/9d57d8a23142b316282bdfc954cb0ecda40a8655 (opens in a new tab)x_transferred
https://en.wikipedia.org/wiki/Time_complexity (opens in a new tab)x_transferred
FEDORA-2022-6bcee2cc93 (opens in a new tab)vendor-advisoryx_transferred
FEDORA-2022-f1aed93db8 (opens in a new tab)vendor-advisoryx_transferred
FEDORA-2022-dc6d6d9d6c (opens in a new tab)vendor-advisoryx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-39209](https://cveledger.app/badge/CVE-2022-39209.svg)](https://cveledger.app/cve/CVE-2022-39209)

Record last updated 23 Apr 2025, 17:10 UTC.