Denial of service in table parsing in cmark-gfm
Priority LOW 32CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.
Why it matters now
EPSS 0.01566 75th percentileScored 2026-11-07
Fix Fixed cmark-gfm (github): 0.29.0.gfm.1Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GitHub | cmark-gfm | before 0.29.0.gfm.1 | 0.29.0.gfm.1 | Patch available | CNA |
- cmark-gfm VendorGitHub Affected before 0.29.0.gfm.1 Fixed in 0.29.0.gfm.1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:github_flavored_markdown_project:github_flavored_markdown:*:*:*:*:*:*:*:* | before 0.29.0.gfm.1 | Vulnerable | Github Flavored Markdown Project |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:github_flavored_markdown_project:github_flavored_markdown:*:*:*:*:*:*:*:* Versions before 0.29.0.gfm.1 Vulnerable ·Github Flavored Markdown Project
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA cmark-gfm (github) Fixed in 0.29.0.gfm.1
Red Hat 1 advisory
- RHSA-2021:1972 Released 2021-05-18 · Red Hat rating Moderatepandoc security update
- Red Hat CodeReady Linux Builder (v. 8) pandoc-2.0.6-5.el8, pandoc-common-2.0.6-5.el8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2021:1972 |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5238
References
More GitHub vulnerabilities
- TI-2024-04632 An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES)… CVSS 4.0CRITICAL 10.0
- TI-2024-00181 Unsafe Reflection in Github Enterprise Server leading to Command Injection CVSS 3.1CRITICAL 9.8
- TI-2024-00466 Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server CVSS 3.1HIGH 8.8
- TI-2022-08539 Integer overflow in table parsing extension leads to heap memory corruption CVSS 3.1CRITICAL 9.8
- TI-2026-34990 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler CVSS 3.1HIGH 7.5
- TI-2026-32884 GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor CVSS 4.0HIGH 8.5
Sources
- CVE-2020-5238 · CVE Program
- CVE-2020-5238 · NVD
- FIRST EPSS
- CVE-2020-5238 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences