Exponential event growth with `ENABLE_WIKILINKS`
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.13.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The pulldown-cmark Markdown parser library is affected when the ENABLE_WIKILINKS option is turned on, including via Options::all(). A small crafted Markdown document can make it produce exponentially many events, exhausting memory and potentially crashing applications that parse untrusted input.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
When `Options::ENABLE_WIKILINKS` is enabled, a wikilink with a pipe separator and empty display text, such as `[[a|]]`, leaks its child node's sibling chain into the content that follows it. Each such link roughly doubles the number of events the parser yields for the rest of the document, so output grows exponentially with input size: 16 repetitions of `[[a|]] ` (112 bytes) yield 327,676 events, where the fixed parser yields 65. A document of a few kilobytes is enough to exhaust memory in a process that collects the events or renders them to HTML. Applications that parse untrusted Markdown with `ENABLE_WIKILINKS` set, including through `Options::all()`, are affected. The option is off by default. Parsing without it is not affected. The flaw was fixed in #1102 and released in 0.13.5.
Timeline
- Advisory published
- Record last updated
Affected versions
- pulldown-cmarkcrates.io
From 0.13.0 · fixed in 0.13.5