gomarkdown 0.0.0-2024 URL Safety Check parser/parser.go parser.IsSafeURL memory corruption

Summaryinfo

A vulnerability was found in gomarkdown markdown and classified as problematic. This impacts the function parser.IsSafeURL of the file parser/parser.go of the component URL Safety Check. The manipulation results in memory corruption. This vulnerability is known as CVE-2026-102941. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in gomarkdown markdown. Affected is the function parser.IsSafeURL of the file parser/parser.go of the component URL Safety Check. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on availability. CVE summarizes:

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longer prefix is sliced. Demonstrated panic cases include empty, ., and .. destinations under those conditions. The panic is reachable when markdown.ToHTML renders untrusted Markdown with html.Safelink enabled, including an empty link destination, and is also reachable by callers that pass a short attacker-controlled URL directly to the exported parser.IsSafeURL function. An uncaught panic can terminate the calling process and cause denial of service. This issue is fixed in 0.0.0-20260724235538-61af6e1e6971.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-102941 since 09/29/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 0.0.0-20260724235538-61af6e1e6971 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• gomarkdown

Name

• markdown

Version

• 0.0.0-2024

Website

• Product: https://github.com/gomarkdown/markdown/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion