Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-28626

CVE-2023-28626: Comrak vulnerable to quadratic runtime issues when parsing Markdown (GHSL-2023-047)

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-28626
GHSA ID
GHSA-8hqf-xjwp-p67v
EPSS Score
0.48676%
CWE
CWE-400
Published
3/28/2023
Updated
5/1/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
comrakrust< 0.17.00.17.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from multiple quadratic parsing issues inherited from cmark. Key areas identified:

  1. Emphasis handling (process_emphasis) had O(n²) behavior due to delimiter stack mismanagement, as seen in CVE-2023-28626's reference to cmark#389.
  2. HTML block parsing lacked state tracking (skip_html_cdata/etc flags added in commit), addressing issues like cmark#299.
  3. Email autolink validation allowed excessive domain checks (addressed via position constraints).
  4. Table parsing improvements (table_visited flag) prevent redundant cell scans. The commit diff shows critical optimizations in these areas, replacing pest-based parsing with re2c scanners for linear-time lexing.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t * r*n** o* qu**r*ti* p*rsin* issu*s *rom `*m*rk`/`*m*rk-**m` *r* *lso pr*s*nt in *omr*k. T**s* **n ** us** to *r**t **ni*l-o*-s*rvi** *tt**ks on s*rvi**s t**t us* *omr*k to p*rs* M*rk*own. ### P*t***s *.**.* *ont*ins *ix*s to known qu**r*

Reasoning

T** vuln*r**ility st*ms *rom multipl* qu**r*ti* p*rsin* issu*s in**rit** *rom *m*rk. K*y *r**s i**nti*i**: *. *mp**sis **n*lin* (pro**ss_*mp**sis) *** O(n²) ****vior *u* to **limit*r st**k mism*n***m*nt, *s s**n in *V*-****-*****'s r***r*n** to *m*rk