Multiple security vulnerabilities have been identified in the gomarkdown Markdown library, affecting versions before the recently update. The issues involve unsafe URL validation, out-of-bounds text processing, and excessive nesting during Markdown parsing. Together they can allow an attacker who can supply untrusted Markdown to cause crashes, resource exhaustion, or denial of service in applications that render or parse the content. The overall risk is primarily availability impact, with the greatest exposure in services that process attacker-controlled Markdown.
CVE-2026-102941 (CVSS 7.5 — High): The URL safety check in the Markdown parser slices a short input before validating its length, causing a slice-bounds panic when an empty or very short link destination is processed. An attacker who can supply Markdown rendered with the URL-sanitizing hardening option, or who can call the exported URL check directly, can trigger an unrecoverable crash and denial of service.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in the gomarkdown Markdown library, affecting versions before the recently update. The issues involve unsafe URL validation, out-of-bounds text processing, and excessive nesting during Markdown parsing. Together they can allow an attacker who can supply untrusted Markdown to cause crashes, resource exhaustion, or denial of service in applications that render or parse the content. The overall risk is primarily availability impact, with the greatest exposure in services that process attacker-controlled Markdown.
CVE-2026-102941 (CVSS 7.5 — High): The URL safety check in the Markdown parser slices a short input before validating its length, causing a slice-bounds panic when an empty or very short link destination is processed. An attacker who can supply Markdown rendered with the URL-sanitizing hardening option, or who can call the exported URL check directly, can trigger an unrecoverable crash and denial of service.[emaillocker id="1283"]
CVE-2026-40890: An out-of-bounds access in the smartypants text-processing component can be triggered by crafted Markdown input. An attacker who can supply content to a parser using that component may cause a crash or abnormal termination.
CVE-2024-44337: An infinite loop in list and paragraph parsing can be triggered by deeply nested or otherwise crafted Markdown. An attacker who can supply such input can cause excessive resource consumption and denial of service.
These vulnerabilities collectively present a significant availability risk for systems that parse or render untrusted Markdown. The most at-risk deployments are services that expose Markdown processing to external input, especially when URL sanitization or smartypants features are enabled. The general action is to assess exposure and prioritize availability impact in services that process untrusted Markdown.
We recommend you to update gomarkdown/markdown to version 0.0.0-20260724235538-61af6e1e6971.
The following reports contain further technical details:
[/emaillocker]