Vulnerability in Commonmarker RubyGem: Denial of Service due to Quadratic Complexity Bugs

commonmarker Updated 02 Oct 2025

Summary

11/04/2023

Disclosed on

MODERATE

Severity

Yes i

Fix available

Moderate

Severity

Not published

CVSS Score

GHSA-48wp-p9qv-4j64: Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service. Affects commonmarker versions < 0.23.9. Fixed in 0.23.9. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Commonmarker is a RubyGem that provides a wrapper around the cmark-gfm library, allowing users to parse and render Markdown documents. It is widely used in Ruby applications for processing Markdown content. However, several quadratic complexity bugs have been discovered in the underlying cmark-gfm library, which can lead to unbounded resource exhaustion and subsequent denial of service.

Vulnerability Detail

The vulnerabilities in the cmark-gfm library used by Commonmarker are caused by quadratic complexity bugs. These bugs can be exploited to perform operations that require a significant amount of time and resources, leading to a denial of service. An attacker could craft malicious Markdown content that triggers these bugs, causing the application to consume excessive CPU and memory, ultimately rendering it unresponsive. The vulnerabilities have been assigned the following CVE identifiers: CVE-2023-24824 and CVE-2023-26485.

How To Fix

Minimum fixed version

0.23.9

This is the first release that contains the fix.

gem install commonmarker -v 0.23.9

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There are no known workarounds for these vulnerabilities. It is crucial to upgrade to the fixed version of Commonmarker to mitigate the risk of denial of service attacks.

Conclusion

Commonmarker RubyGem is vulnerable to denial of service attacks due to quadratic complexity bugs in the underlying cmark-gfm library. To mitigate this risk, it is crucial to upgrade to Commonmarker version 0.23.9. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for commonmarker →