[junkdog]

Affected crate(s)

• pulldown-cmark (61.8M recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

• Report: Request a 0.13.5 patch release: exponential blowup with ENABLE_WIKILINKS (#1102) and two panics (#1111, #1129) pulldown-cmark/pulldown-cmark#1179
• Fix: Fix: wikilink with pipe separator leaks child node's next chain into sibling content pulldown-cmark/pulldown-cmark#1102
• Release 0.13.5, described by the maintainers as fixing security issues: Release 0.13.5 pulldown-cmark/pulldown-cmark#1181

Severity

Remote denial-of-service via memory exhaustion. With Options::ENABLE_WIKILINKS set (off by default, included in Options::all()), each wikilink with a pipe and empty display text, such as [[a|]], roughly doubles the events yielded for the rest of the document: 112 bytes yield 327,676 events (65 when fixed), and a few kilobytes exhaust memory in a process that collects or renders the events. Affects 0.13.0 through 0.13.4; wikilinks were introduced in 0.13.0, and 0.13.5 is patched.

CVSS 3.1 is 7.5, scored for a service that renders untrusted Markdown with wikilinks enabled. AC:H, to account for the option being off by default, would give 5.9.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate: the draft was posted on Request a 0.13.5 patch release: exponential blowup with ENABLE_WIKILINKS (#1102) and two panics (#1111, #1129) pulldown-cmark/pulldown-cmark#1179 and approved by the maintainer

[djc]

Thanks!