Cve-2026-40890 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-40890/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 22 Apr 2026 12:00:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGo-Markdown Library Vulnerable to Out-of-Bounds Read via Malformed Inputhttps://feed.craftedsignal.io/briefs/2026-04-22-gomarkdown-oob-read/Wed, 22 Apr 2026 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-04-22-gomarkdown-oob-read/The `github.com/gomarkdown/markdown` Go library is susceptible to an out-of-bounds read or panic when processing malformed input with the SmartypantsRenderer, potentially leading to a denial-of-service condition.The github.com/gomarkdown/markdown library, a widely used Go package for parsing Markdown and rendering it as HTML, contains a vulnerability (CVE-2026-40890) that can be triggered by processing specially crafted Markdown input. Specifically, if the input contains a < character that is not subsequently closed by a > character, the SmartypantsRenderer will cause an out-of-bounds read or panic. This issue was introduced in an earlier version of the library and was addressed in commit 759bbc3e32073c3bc4e25969c132fc520eda2778. Exploitation of this vulnerability can lead to a denial-of-service (DoS) condition, affecting applications that rely on this library to process untrusted Markdown content. Defenders should ensure they are running a patched version of the library.

Attack Chain

  1. An attacker crafts a malicious Markdown document containing a < character without a closing > character.
  2. A user or automated system submits the malicious Markdown document to an application using the vulnerable github.com/gomarkdown/markdown library.
  3. The application calls the markdown.ToHTML function with the crafted Markdown and uses SmartypantsRenderer to render to HTML.
  4. The SmartypantsRenderer attempts to process the malformed < character.
  5. Due to the missing >, the renderer attempts to read beyond the bounds of the input buffer, triggering an out-of-bounds read.
  6. The out-of-bounds read leads to a panic within the Go application.
  7. The panic crashes the Go application, causing a denial-of-service.

Impact

Successful exploitation of this vulnerability results in a denial-of-service condition. Applications using the vulnerable version of github.com/gomarkdown/markdown may crash when processing attacker-controlled Markdown input. The severity of the impact depends on the role of the affected application; if it is a critical service, the denial of service could have significant consequences. The number of potential victims is proportional to the number of applications using the vulnerable github.com/gomarkdown/markdown library and processing potentially untrusted Markdown content.

Recommendation

  • Update the github.com/gomarkdown/markdown library to a version containing commit 759bbc3e32073c3bc4e25969c132fc520eda2778 or later to remediate the vulnerability.
  • Implement input validation to sanitize Markdown input before processing it with the github.com/gomarkdown/markdown library.
]]>mediumadvisorymarkdowngodenial-of-servicecve-2026-40890