{"id":"RSEC-2023-6","summary":"Denial of Service (DoS) vulnerability","details":"The commonmark package, specifically in its dependency on GitHub Flavored Markdown before version 0.29.0.gfm.1, has a vulnerability related to time complexity. Parsing certain crafted markdown tables can take O(n * n) time, leading to potential Denial of Service attacks. This issue does not affect the upstream cmark project and has been fixed in version 0.29.0.gfm.1.","modified":"2025-05-19T19:43:47.903227Z","published":"2023-10-06T05:00:00.600Z","upstream":["CVE-2020-5238"],"references":[{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2020-5238"},{"type":"WEB","url":"https://github.com/r-lib/commonmark/issues/13"},{"type":"WEB","url":"https://github.com/r-lib/commonmark/pull/18"}],"affected":[{"package":{"name":"commonmark","ecosystem":"CRAN","purl":"pkg:cran/commonmark"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2"},{"fixed":"1.8"}]}],"versions":["0.2","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.2","1.4","1.5","1.6","1.7"],"database_specific":{"source":"https://github.com/RConsortium/r-advisory-database/blob/main/vulns/commonmark/RSEC-2023-6.yaml"}}],"schema_version":"1.7.3"}