rustsec-2026-0433

debian_rustsec
Description

With `Options::ENABLE_WIKILINKS`, handle_wikilink builds a wikilink's target from the raw text of its body: scan_wikilink_pipe walks it looking for |, then contains('\0') and from_replace_nuls walk it again. Once a wikilink is created, disable_all_links only disables Link entries, so every enclosing `![[` stays live on the wikilink stack. On `![[![[![[…]]]]]]` each of those openers then resolves in turn and rescans everything inside it, which is quadratic in the nesting depth. The event count stays tiny, because in the unpiped case each enclosing image replaces its body with a fresh text node, so all of that work is thrown away. Applications that parse untrusted Markdown with `ENABLE_WIKILINKS` set, including through `Options::all()`, are affected. The option is off by default. Parsing without it is not affected. The flaw was fixed in [#1186](https://github.com/pulldown-cmark/pulldown-cmark/pull/1186) and released in 0.13.6.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "aliases": [],
  "categories": [
    "denial-of-service"
  ],
  "crate": "pulldown-cmark",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": "high"
  },
  "date": "2026-10-28",
  "deb_packages": [
    {
      "crate_name": "debian-lsp",
      "deb_name": "debian-lsp",
      "version": "0.1.8-5+b2"
    },
    {
      "crate_name": "just",
      "deb_name": "just",
      "version": "1.59.0-1"
    },
    {
      "crate_name": "pulldown-cmark",
      "deb_name": "librust-pulldown-cmark-dev",
      "version": "0.13.5+ds-1"
    },
    {
      "crate_name": "ognibuild",
      "deb_name": "ognibuild",
      "version": "0.2.21-1"
    },
    {
      "crate_name": "pulldown-cmark",
      "deb_name": "pulldown-cmark",
      "version": "0.13.5+ds-1"
    },
    {
      "crate_name": null,
      "deb_name": "rustup",
      "version": "1.27.1-8+b2"
    },
    {
      "crate_name": "so",
      "deb_name": "so",
      "version": "0.4.10-4+b2"
    }
  ],
  "description": "With `Options::ENABLE_WIKILINKS`, handle_wikilink builds a wikilink's target\nfrom the raw text of its body: scan_wikilink_pipe walks it looking for |, then\ncontains('\\0') and from_replace_nuls walk it again.\nOnce a wikilink is created, disable_all_links only disables Link entries, so\nevery enclosing `![[` stays live on the wikilink stack.\nOn `![[![[![[…]]]]]]` each of those openers then resolves in turn and rescans\neverything inside it, which is quadratic in the nesting depth.\nThe event count stays tiny, because in the unpiped case each enclosing image\nreplaces its body with a fresh text node, so all of that work is thrown away.\n\nApplications that parse untrusted Markdown with `ENABLE_WIKILINKS` set,\nincluding through `Options::all()`, are affected. The option is off by default.\nParsing without it is not affected.\n\nThe flaw was fixed in\n[#1186](https://github.com/pulldown-cmark/pulldown-cmark/pull/1186) and\nreleased in 0.13.6.",
  "id": "RUSTSEC-2026-0433",
  "keywords": [
    "markdown",
    "wikilinks",
    "memory-exhaustion"
  ],
  "patched_versions": [
    ">=0.13.6"
  ],
  "source": "debian_rustsec",
  "title": "Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`",
  "url": "https://github.com/pulldown-cmark/pulldown-cmark/pull/1186"
}
View JSON API Download JSON