HSEC-2025-0007

See a problem?
Import Source
https://github.com/haskell/security-advisories/blob/generated/osv-export/2025/HSEC-2025-0007.json
JSON Data
https://api.osv.dev/v1/vulns/HSEC-2025-0007
Published
2025-12-27T08:58:56Z
Modified
2025-12-27T09:03:44.138388Z
Summary
cmark-gfm: resource exhaustion due to quadratic complexity in parser
Details

cmark-gfm: resource exhaustion due to quadratic complexity in parser

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service, due to quadratic complexity issues when parsing text which leads with either large numbers of > or - characters.

The Haskell cmark-gfm package bundles the C sources and was affected by this issue. This fix was released in the upstream C package at version 0.29.0.gfm.10. Version 0.2.6 of the Haskell package adopted the fix (moving from 0.29.0.gfm.6 to 0.29.0.gfm.13). Packages that depend on cmark-gfm should update to 0.2.6 or later.

Users unable to update should avoid processing data from untrusted sources or validate the input with other tools before using cmark-gfm to parse it.

Pandoc < 2.10.1 depended on cmark-gfm and could be affected by this issue.

Database specific 
{
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "home": "https://github.com/haskell/security-advisories",
    "repository": "https://github.com/haskell/security-advisories"
}
References

Affected packages

Hackage / cmark-gfm

Package

Name
cmark-gfm
Purl
pkg:hackage/cmark-gfm

Severity

  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.1.0
Fixed
0.2.6

Affected versions

0.*

0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5

Database specific

human_link

"https://github.com/haskell/security-advisories/tree/main/advisories/published/2025/HSEC-2025-0007.md"

source

"https://github.com/haskell/security-advisories/blob/generated/osv-export/2025/HSEC-2025-0007.json"

osv

"https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2025/HSEC-2025-0007.json"