CVE-2024-22051

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22051

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

C

ommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.

References
Link Resource
https://github.com/advisories/GHSA-fmx4-26r3-wxpf Third Party Advisory
https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x Not Applicable
https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3 Patch
https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf Third Party Advisory
https://github.com/advisories/GHSA-fmx4-26r3-wxpf Third Party Advisory
https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x Not Applicable
https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3 Patch
https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:github:cmark-gfm:*:*:*:*:*:*:*:*
cpe:2.3:a:github:cmark-gfm:*:*:*:*:*:*:*:*
cpe:2.3:a:gjtorikian:commonmarker:*:*:*:*:*:ruby:*:*
History

29 Nov 2025, 02:15

Type Values Removed Values Added
Summary (en) CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns. (en) CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.

21 Nov 2024, 08:55

Type Values Removed Values Added
References () https://github.com/advisories/GHSA-fmx4-26r3-wxpf - Third Party Advisory () https://github.com/advisories/GHSA-fmx4-26r3-wxpf - Third Party Advisory
References () https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x - Not Applicable () https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x - Not Applicable
References () https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3 - Patch () https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3 - Patch
References () https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf - Vendor Advisory () https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf - Vendor Advisory
References () https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf - Third Party Advisory () https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf - Third Party Advisory
Information

Published : 2024-01-04 21:15

Updated : 2025-11-29 02:15

NVD link : CVE-2024-22051

Mitre link : CVE-2024-22051

CVE.ORG link : CVE-2024-22051

JSON object : View

Products Affected

gjtorikian

github

CWE
CWE-190

Integer Overflow or Wraparound