CVE-2023-28626 Quadratic runtime when parsing Markdown in comrak
Attackers can cause denial of service in applications using the comrak Rust library by submitting crafted Markdown input that triggers quadratic parsing time.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-28626?
CVE-2023-28626 is a medium-severity denial of service vulnerability in kivikakk comrak, published on 28 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. This issue has been addressed in version 0.17.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-047`
Weakness: CWE-400
Which versions are affected by CVE-2023-28626?
2 open source packages ship an affected version, including comrak. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
comrak crates.io | All versions | 0.17.0 |
comrak crates.io | All versions | 0.17.0 |
Products include Comrak Project Comrak.
How do I fix CVE-2023-28626?
Upgrade comrak to 0.17.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-28626 being exploited?
There is no known exploitation of CVE-2023-28626 in the wild and no public exploit code.
Other vulnerabilities in kivikakk comrak
Sources
Also known as GHSA-8hqf-xjwp-p67v.