Skip to content
Fencer Vulns
high 7.5

CVE-2026-102941 json

gomarkdown/markdown IsSafeURL panics on short URLs

published 2026-10-16 23 d ago modified 2026-10-26 13 d ago also GHSA-cv23-7vc5-jfh7 , EUVD-2026-102934

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longer prefix is sliced. Demonstrated panic cases include empty, ., and .. destinations under those conditions. The panic is reachable when markdown.ToHTML renders untrusted Markdown with html.Safelink enabled, including an empty link destination, and is also reachable by callers that pass a short attacker-controlled URL directly to the exported parser.IsSafeURL function. An uncaught panic can terminate the calling process and cause denial of service. This issue is fixed in 0.0.0-20260724235538-61af6e1e6971.

Patch / fix

  • go github.com/gomarkdown/markdown 0.0.0-20260724235538-61af6e1e6971
  • golang-github-gomarkdown-markdown Debian 14 0.0~git20260725.8435af3-1

debian advisories DEBIAN-CVE-2026-102941

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-102941 updated cvss 7.5

github.com/gomarkdown/markdown: github.com/gomarkdown/markdown: Denial of Service via short URL parsing

  • Red Hat Ansible Automation Orchestrator 2026 ansible-automation-platform/automation-orchestrator-temporal-rhel9
    affected: workaround, no fix available
  • Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-grafana-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel9 Red Hat OpenShift Container Platform 4 cri-o, openshift4/kube-metrics-server-rhel8, openshift4/kube-metrics-server-rhel9 Red Hat OpenShift Container Platform 5 openshift5/kube-metrics-server-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
13 d ago

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/gomarkdown/markdown
<0.0.0-20260724235538-61af6e1e6971
0.0.0-20260724235538-61af6e1e6971

Affected products

  • gomarkdown markdown

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.