SB20261109104 - Inefficient Algorithmic Complexity in Comrak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109104

SB20261109104 - Inefficient Algorithmic Complexity in Comrak

Published: November 9, 2026

Security Bulletin ID SB20261109104
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause CPU-based denial of service in applications that render untrusted Markdown using Comrak with the table extension enabled.

The vulnerability exists due to repeated traversal of table cells during HTML and XML rendering, causing processing time to grow quadratically with the number of columns. An unauthenticated remote attacker can submit a table of approximately 130 KB that consumes about three seconds of CPU time per HTML render.


Remediation

Install update from vendor's website.

References