Inefficient Algorithmic Complexity in Comrak - #VU162815
Published: November 9, 2026
Vulnerability identifier: #VU162815
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause CPU-based denial of service in applications that render untrusted Markdown using Comrak with the table extension enabled.
The vulnerability exists due to repeated traversal of table cells during HTML and XML rendering, causing processing time to grow quadratically with the number of columns. An unauthenticated remote attacker can submit a table of approximately 130 KB that consumes about three seconds of CPU time per HTML render.
Affected software
Comrak
Remediation
Install security update from vendor's website.
Comrak - update to 0.58.0