CVE-2024-22051
Critical
Description
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.
SeverityCritical
CVSS9.8
Exploit probability—
ProductGjtorikian Commonmarker
PublishedJan 4, 2024
First seenJan 4, 2024
Weakness typeCWE-190Integer overflow
How to fix
Update
- gjtorikian commonmarker0.23.4 or later
- github cmark-gfm0.28.3.gfm.21, 0.29.0.gfm.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gjtorikian commonmarker | v < 0.23.4 | 0.23.4 |
| github cmark-gfm | v < 0.28.3.gfm.21, 0.29.0.gfm.0 ≤ v < 0.29.0.gfm.3 | 0.28.3.gfm.21, 0.29.0.gfm.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.