github.com/gomarkdown/markdown Out-of-bounds Read while parsing citations

CVE-2023-42821

What is CVE-2023-42821?

The Go library for parsing Markdown, 'github.com/gomarkdown/markdown', is susceptible to an out-of-bounds read due to malformed input when using the parser.Mmark extension. This vulnerability occurs in the 'citation.go' file at line 69, where the parser attempts to access an element beyond its length, which can lead to a denial of service. A patch is included in the commit '14b16010c2ee7ff33a940a541d993bd043a88940' to mitigate the issue.

References