With table extension, one may get awfully long output with input generated by this python one-liner:

$ python -c 'N=100; print("x|" * N + "\n" + "-|" * N + "\n" + "x\n" * N)' | pulldown-cmark -T

The output size grows roughly as square of the input size. With N=10000 you still have an input of decent size (~70kB), but the corresponding output is roughly ~900MB (10000 * 10000 * strlen("<td></td>")), so it's potentially usable as DoS attack vector.

(In MD4C I solved this by limiting column count of tables to 128. Anything bigger is refused to be recognized as a table. Probably the only alternative would be to stop emitting empty table cells if they're missing in the input, breaking compatibility with GFM.)