Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-26485

23
FAUCET Score

CVE-2023-26485 describes a polynomial time complexity vulnerability in cmark-gfm, GitHub's fork of the cmark CommonMark parsing library, affecting versions prior to 0.29.0.gfm.10. This denial-of-service (DoS) vulnerability, rated High severity (CVSS 7.5), allows an unauthenticated attacker to cause unbounded resource exhaustion by submitting specially crafted input containing a large number of underscore characters. While there is no evidence of active exploitation or public exploit code, the issue can lead to significant service disruption. Users are strongly advised to upgrade to the patched version or validate input from trusted sources.

Impacted Technologies

VendorProductVersion(s)CPE
< 0.29.0.gfm.10CPE matchmatch criteria
cpe:2.3:a:github:cmark-gfm:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.3MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
Exploitability Score
3.9
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.03%
Probability of exploitation in next 30 days
EPSS Percentile
60.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0103 is in the 37th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

github_advisorypatch availablevia nvd_reference
View patch
redhatno patchvia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: commonmarker

Vendor Advisories (1)

redhatCVE-2023-26485Moderate

commonmarker: Quadratic complexity bug may lead to a denial of service

Apr 1, 2023

References

github.com / github/cmark-gfm/commit/07a66c9bc341f902878e37d7da8647d6ef150987
Patch
github.com / github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5
ExploitVendor Advisory