VDB

CVE-2020-5238

CVE-2020-5238 PUBLISHED

The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.

EPSS 0.51% · 66.7th percentile

Risk Scores

EPSS Score
0.51%
66.7th percentile

Affected Products

VendorProductVersions
Ubuntu:25.10haskell-cmark-gfm*, 0
Ubuntu:Pro:20.04:LTScmark-gfm0.28.3.gfm.20-3, 0, 0.29.0.gfm.0-4ubuntu0.1~esm1
Ubuntu:20.04:LTShaskell-cmark-gfm0, 0.1.8-1build1
Ubuntu:24.04:LTSpython-cmarkgfm0.8.0-3, 0
Ubuntu:25.10python-cmarkgfm2024.11.20-1, 0, 0.8.0-3
Ubuntu:22.04:LTSr-cran-commonmark0, 1.7-2
Ubuntu:20.04:LTSruby-commonmarker0.20.2-1build1, 0, 0.17.9-1
Ubuntu:20.04:LTSpython-cmarkgfm0, 0.4.2-1build2, 0.4.2-1build1
Ubuntu:22.04:LTSpython-cmarkgfm0.4.2-1build5, 0.8.0-1, 0
Ubuntu:24.04:LTShaskell-cmark-gfm*, 0.2.5+ds1-1build2, 0
Ubuntu:22.04:LTShaskell-cmark-gfm0.2.1+ds1-2build1, 0.2.1+ds1-2build2, 0.2.1+ds1-1build1
Ubuntu:25.10r-cran-commonmark1.9.5-1, 0
Ubuntu:20.04:LTSr-cran-commonmark1.7-1, 0
Ubuntu:24.04:LTSr-cran-commonmark1.9.1-1, 1.9.0-1, 0

Exploit Intelligence

Timeline

  • Jul 1, 2020 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 24, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 28, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 1, 2022 EPSS Score
  • Jul 3, 2022 EPSS Score
  • Sep 4, 2022 EPSS Score
  • Nov 6, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›