CVE-2020-5238

The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.

• CWE-20
• CWE-20

• https://github.com/github/cmark-gfm/commit/85d895289c5ab67f988ca659493a64abb5fec7b4Patch, Third Party Advisory
• https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5-hc85Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCDHBTUFIOYRIS5HAS6PZNBNMB7IOAX3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMQFOQQCWOAMQ4I2XIVCVOXXIJ75HDCW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGJH2A4VAV54X6NSCNNGSEIGIIY5N2VR/
• https://github.com/github/cmark-gfm/commit/85d895289c5ab67f988ca659493a64abb5fec7b4Patch, Third Party Advisory
• https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5-hc85Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCDHBTUFIOYRIS5HAS6PZNBNMB7IOAX3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMQFOQQCWOAMQ4I2XIVCVOXXIJ75HDCW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGJH2A4VAV54X6NSCNNGSEIGIIY5N2VR/

Published

Jul 1, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5232A user who owns an ENS domain can set a trapdoor, allowing t…8.7
• CVE-2020-5233OAuth2 Proxy before 5.0 has an open redirect vulnerability. …6.1
• CVE-2020-5234MessagePack for C# and Unity before version 1.9.11 and 2.1.9…6.5
• CVE-2020-5235There is a potentially exploitable out of memory condition I…9.8
• CVE-2020-5236Waitress version 1.4.2 allows a DOS attack When waitress rec…6.5
• CVE-2020-5237Multiple relative path traversal vulnerabilities in the oneu…8.8
• CVE-2020-5239In Mailu before version 1.7, an authenticated user can explo…8.8
• CVE-2020-5240In wagtail-2fa before 1.4.1, any user with access to the CMS…8.5
• CVE-2020-5241matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XS…5.4
• CVE-2020-5242openHAB before 2.5.2 allow a remote attacker to use REST cal…8.8
• CVE-2020-5243uap-core before 0.7.3 is vulnerable to a denial of service a…7.5
• CVE-2020-5244In BuddyPress before 5.1.2, requests to a certain REST API e…7.5