Critical
CommonMarker Integer Overflow Vulnerability
Type: advisorySources: OSV
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-22051
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 09:04 UTC · Revision 1
Source evidence
CommonMarker Integer Overflow Vulnerability
core-osv · Original sourcePublished 4 Jan 2024, 20:27 UTC
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.
osv:CVE-2024-22051
Complete source record
{
"id": "a86268f1e74b3c75e7d7018a0c296ab39d5ea5ad11af9b56c9c0680d4da6e704",
"url": "https://osv.dev/vulnerability/CVE-2024-22051",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CommonMarker Integer Overflow Vulnerability",
"summary": "CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.",
"evidence": "osv:CVE-2024-22051",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2024-22051",
"aliases": [
"CVE-2024-22051",
"GHSA-fmx4-26r3-wxpf"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/github/cmark-gfm",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "6fc5672293c1052e2fb7ab65a92a41495cb6426a"
},
{
"introduced": "b8eb2e00de094999f978e9cb02b1a78d810812d3"
},
{
"fixed": "cf7577d2f74289cb83de0a652afc1a8b08a37036"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:github:cmark-gfm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.28.3.gfm.21"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:github:cmark-gfm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.29.0.gfm.0"
},
{
"fixed": "0.29.0.gfm.3"
}
],
"source": "CPE_RANGE"
}
]
}
},
{
"repo": "https://github.com/gjtorikian/commonmarker",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ccb0f64c1980c06fb0c38ab0bf14737ed0f256ea"
},
{
"fixed": "ab4504fd17460627a6ab255bc3c63e8e5fc6aed3"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gjtorikian:commonmarker:*:*:*:*:*:ruby:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.23.4"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "ab4504fd17460627a6ab255bc3c63e8e5fc6aed3"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"0.28.3.gfm.20",
"0.29.0.gfm.2",
"0.29.0.gfm.1",
"0.29.0.gfm.0",
"0.28.3.gfm.19",
"0.28.3.gfm.18",
"0.28.3.gfm.17",
"0.28.3.gfm.16",
"0.28.3.gfm.15",
"0.28.3.gfm.14",
"0.28.3.gfm.13",
"0.28.3.gfm.12",
"0.28.0.gfm.11",
"0.28.0.gfm.10",
"0.28.0.gfm.9",
"0.28.0.gfm.8",
"0.28.0.gfm.7",
"0.28.0.gfm.6",
"0.28.0.gfm.5",
"0.27.1.gfm.4",
"0.27.1.gfm.3",
"0.27.1.gfm.2",
"v0.17.13",
"v0.18.2",
"v0.23.2",
"v0.23.1",
"v0.23.0",
"v0.22.0",
"v0.21.2",
"v0.21.1",
"v0.21.0",
"v0.20.2",
"v0.20.1",
"v0.20.0",
"v0.19.0",
"v0.18.1",
"v0.18.0",
"v0.17.12",
"v0.17.11",
"v0.17.10",
"0.17.10",
"v0.17.9",
"v0.17.8",
"v0.17.7.1",
"v0.17.7",
"v0.17.6",
"v0.17.5",
"0.17.4",
"0.17.3",
"0.17.2",
"0.17.1",
"0.17.0",
"0.16.9",
"0.16.8",
"0.16.7",
"0.16.6",
"0.16.5",
"0.16.4",
"0.16.3",
"0.16.2",
"0.16.1",
"v0.16.0",
"v0.15.0",
"v0.14.15",
"v0.14.14",
"v0.14.13",
"v0.14.12",
"v0.14.11",
"v0.14.10",
"v0.14.9",
"v0.14.8",
"v0.14.7",
"v0.14.6",
"v0.14.5",
"v0.14.4",
"v0.14.3",
"v0.14.2",
"v0.14.1",
"v0.14.0",
"v0.13.0",
"v0.12.0",
"v0.11.0",
"v0.10.0",
"v0.9.2",
"v0.9.1",
"v0.9.0",
"v0.8.0",
"v0.7.0",
"v0.6.0",
"v0.5.1",
"v0.5.0",
"v0.4.1",
"v0.4.0",
"v0.3.0",
"v0.2.1",
"v0.2.0",
"v0.1.3",
"v0.1.2",
"v0.1.1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22051.json"
}
}
],
"modified": "2026-10-28T02:30:34.388484977Z",
"provider": "osv",
"references": [
"https://rubygems.org",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22051.json",
"https://github.com/advisories/GHSA-fmx4-26r3-wxpf",
"https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x",
"https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf",
"https://nvd.nist.gov/vuln/detail/CVE-2024-22051",
"https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf",
"https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3"
],
"provider_metadata": {
"cwe_ids": [
"CWE-190"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22051.json"
}
},
"related_cves": [
{
"value": "CVE-2024-22051",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 501310,
"published_at": "2024-01-04T20:27:22.197+00:00"
}