How severe is CVE-2023-22484?

CVE-2023-22484 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2023-22484 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-22484?

CVE-2023-22484 affects Github Cmark-gfm. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-22484?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-22484 published?

CVE-2023-22484 was published on 2023-01-23 and last updated on 2026-06-17.

CVE-2023-22484

CVE-2023-22484 is a low-severity vulnerability in Github Cmark-gfm with a CVSS 3.x base score of 3.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-407.

Key facts

Severity: Low (CVSS 3.x base score 3.5)
EPSS exploit prediction: 1% (57th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-407
Affected product: Github Cmark-gfm
Published: 2023-01-23
Last modified: 2026-06-17

Description

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.

Frequently asked questions

What is CVE-2023-22484?: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.
How severe is CVE-2023-22484?: CVE-2023-22484 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2023-22484 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-22484?: CVE-2023-22484 affects Github Cmark-gfm. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-22484?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-22484 published?: CVE-2023-22484 was published on 2023-01-23 and last updated on 2026-06-17.

References

https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r

Affected products (1)

cpe:2.3:a:github:cmark-gfm:*:*:*:*:*:*:*:*

More vulnerabilities in Github Cmark-gfm

CVE-2024-22051 — Critical (CVSS 9.8): CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result…
CVE-2022-24724 — High (CVSS 8.8): cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3…
CVE-2022-39209 — High (CVSS 7.5): cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to…
CVE-2023-37463 — Medium (CVSS 6.4): cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown…
CVE-2023-26485 — Medium (CVSS 5.3): cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time…
CVE-2023-24824 — Medium (CVSS 5.3): cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time…

All CVEs affecting Github Cmark-gfm →

Other CWE-407 vulnerabilities

CVE-2026-58226 — High (CVSS 8.7): Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via…
CVE-2026-54892 — High (CVSS 8.7): Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to…
CVE-2026-59094 — High (CVSS 7.5): Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed…
CVE-2026-53433 — High (CVSS 7.5): fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to…
CVE-2026-13311 — High (CVSS 7.5): shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator,…
CVE-2026-48516 — High (CVSS 7.5): MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7,…

Browse all CWE-407 vulnerabilities →