GHSA-xxmq-4vph-956w Comrak vulnerable to production of excessive output when parsing Markdown (GHSL-2023-048)
Attackers can cause excessive output and resource exhaustion by submitting Markdown with many references, impacting availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xxmq-4vph-956w?
GHSA-xxmq-4vph-956w is a denial of service vulnerability in comrak, published on 28 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
comrak is vulnerable to the upstream cmark issue, "Issue revealed by fuzzer". A large number of references in a markdown document can trigger an overly large response.
Patches
0.17.0 contains https://github.com/kivikakk/comrak/commit/70f97f3ea4eae30ffbd1b94c764a3de2f1c41d2a, which limits reference output to a 100Kb maximum.
Workarounds
n/a
References
Which versions are affected by GHSA-xxmq-4vph-956w?
2 open source packages ship an affected version, including comrak.
| Package | Affected | Fixed in |
|---|---|---|
comrak crates.io | All versions | 0.17.0 |
comrak crates.io | All versions | 0.17.0 |
How do I fix GHSA-xxmq-4vph-956w?
Upgrade comrak to 0.17.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-xxmq-4vph-956w being exploited?
There is no known exploitation of GHSA-xxmq-4vph-956w in the wild and no public exploit code.