Moderate Vulnerability in Pandoc: Denial of Service Risk Due to cmark-gfm Complexity Bugs
Summary
RLSA-2025:8427: Moderate: pandoc security update. Affects pandoc versions < 0:2.0.6-7.el8_10. Fixed in 0:2.0.6-7.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pandoc is a versatile Haskell library and command-line tool designed for converting between various markup formats. It supports a wide array of input and output formats, including Markdown, HTML, LaTeX, and many others. Its modular design allows for easy addition of new formats through readers and writers. However, a recent vulnerability has been identified that could lead to denial of service under specific conditions.
Vulnerability Detail
The vulnerability stems from quadratic complexity bugs in the cmark-gfm component of Pandoc, which can be exploited to cause a denial of service. This issue arises when processing certain inputs that lead to excessive resource consumption, potentially crashing the service or making it unresponsive. The CVSS score for this vulnerability is 7.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
0:2.0.6-7.el8_10
This is the first release that contains the fix.
sudo dnf update pandocTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or complex Markdown inputs that may trigger the quadratic complexity issue until the update has been applied.
Conclusion
In summary, a moderate vulnerability has been identified in Pandoc that could lead to denial of service due to quadratic complexity bugs. Users are advised to update to the latest patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for pandoc →
FAQ
The vulnerability is due to quadratic complexity bugs in the cmark-gfm component, which can lead to denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of this vulnerability is 7.5, indicating a moderate severity level.
Update Pandoc to the patched version 0:2.0.6-7.el8_10 using your package manager.
Yes, avoid processing untrusted or complex Markdown inputs until the update is applied.
Related vulnerabilities
Recent vulnerabilities recorded for pandoc.
