Impact

A range of quadratic parsing issues from cmark/cmark-gfm are also present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown.

Patches

0.17.0 contains fixes to known quadratic parsing issues.

Workarounds

n/a

References

• commonmark/cmark#255
• commonmark/cmark#389
• commonmark/cmark#373
• commonmark/cmark#299
• commonmark/cmark#388
• commonmark/cmark#284
• commonmark/cmark#218
• commonmark/cmark#232
• https://github.com/github/cmark-gfm/blob/c32ef78bae851cb83b7ad52d0fbff880acdcd44a/test/pathological_tests.py#L63-L65
• https://github.com/github/cmark-gfm/blob/c32ef78bae851cb83b7ad52d0fbff880acdcd44a/test/pathological_tests.py#L87-L89