Nixpkgs security tracker
8.7 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse dismissed (not in Nixpkgs)
commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.
References
-
GitHub Security Advisory (GHSA-mh25-x5hq-wrqp) vendor-advisory
Affected products
- ==2.8.4
- <2.8.4
Matching in nixpkgs
pkgs.guile-commonmark
Implementation of CommonMark for Guile
-
nixos-unstable 2020-04-30
- nixpkgs-unstable 2020-04-30
- nixos-unstable-small 0.1.2-unstable-2020-04-30
-
nixos-26.05 2020-04-30
- nixos-26.05-small 2020-04-30
- nixpkgs-26.05-darwin 2020-04-30
pkgs.rubyPackages.commonmarker
None
pkgs.haskellPackages.commonmark
Pure Haskell commonmark parser
pkgs.python313Packages.commonmark
Python CommonMark parser
pkgs.python314Packages.commonmark
Python CommonMark parser
pkgs.rubyPackages_3_3.commonmarker
None
pkgs.rubyPackages_3_4.commonmarker
None
pkgs.rubyPackages_4_0.commonmarker
None
pkgs.haskellPackages.commonmark-cli
Command-line commonmark converter and highlighter
pkgs.python313Packages.recommonmark
Docutils-compatibility bridge to CommonMark
pkgs.python314Packages.recommonmark
Docutils-compatibility bridge to CommonMark
pkgs.rubyPackages.jekyll-commonmark
None
pkgs.haskellPackages.commonmark-pandoc
Bridge between commonmark and pandoc AST
pkgs.haskellPackages.commonmark-simple
Simple interface to commonmark-hs for parsing real-world Markdown
pkgs.haskellPackages.commonmark-initial
An initial encoding of the CommonMark language
pkgs.rubyPackages_3_3.jekyll-commonmark
None
pkgs.rubyPackages_3_4.jekyll-commonmark
None
pkgs.rubyPackages_4_0.jekyll-commonmark
None
pkgs.haskellPackages.commonmark-wikilink
Obsidian-friendly commonmark wikilink parser
pkgs.haskellPackages.commonmark-extensions
Pure Haskell commonmark parser
pkgs.rubyPackages.jekyll-commonmark-ghpages
None