CVE-2023-28626: 
Rust vulnerability analysis and mitigation

Comrak, a CommonMark + GFM compatible Markdown parser and renderer written in Rust, was found to contain a range of quadratic parsing issues that could be exploited to perform denial-of-service attacks. The vulnerability, tracked as CVE-2023-28626 and GHSL-2023-047, affects versions prior to 0.17.0. The issue was discovered and disclosed in March 2023 (GitHub Advisory).

The vulnerability stems from multiple quadratic parsing issues inherited from cmark/cmark-gfm that are present in Comrak. These issues cause the parsing runtime to increase quadratically compared to the input size, potentially leading to excessive CPU usage. The vulnerability received a CVSS v3.1 base score of 7.5 HIGH with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, though GitHub assessed it as MEDIUM with a score of 5.3 (NVD).

When exploited, this vulnerability can be used to craft denial-of-service attacks against services that use Comrak to parse Markdown. The quadratic parsing behavior means that specially crafted input can cause excessive CPU consumption, potentially impacting service availability (GitHub Advisory).

The vulnerability has been fixed in Comrak version 0.17.0. Users are advised to upgrade to this version or later. There are no known workarounds for this vulnerability (GitHub Advisory, Fedora Update).