Denial of Service Risk in Markdown Parsing Library from Go Vendor

CVE-2026-102941

What is CVE-2026-102941?

The Go library gomarkdown/markdown contains a vulnerability where improper handling of short URLs in the parser can lead to a slice-bounds panic. This occurs within the function parser.IsSafeURL, specifically when handling untrusted Markdown content with html.Safelink enabled. A malicious user could exploit this vulnerability by providing an attacker-controlled URL to the parser, leading to a potential denial of service as the uncaught panic could cause the calling process to terminate unexpectedly. The issue has been resolved in the newest version.

References