ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-102941

sync 2026-10-16T15:41:51Z

Published Oct 16, 2026 · catalog updated Oct 18, 2026 · sync 2026-10-16T15:41:51Z

Check if you run it

No confirmed exploitation is on record for CVE-2026-102941. EPSS is 0.28%. Act only if a listed version of sync 2026-10-16T15:41:51Z is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (sync 2026-10-16T15:41:51Z).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.28%
Remediation
Version ranges on file
Affected products
Debian:12 golang-github-gomarkdown-markdown · Debian:13 golang-github-gomarkdown-markdown · Debian:14 golang-github-gomarkdown-markdown · Go github.com/gomarkdown/markdown · go github.com/gomarkdown/markdown · golang github.com

## Summary IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022). ## The defect parser/parser.go, IsSafeURL: url[:nPath] is evaluated before the check. When len(url) < nPath and cap(url) < nPath, the slice expression panics. Only the relative-path loop is affected; the adjacent URIs loop is already correctly guarded (the signal that this one deviates, the same signal as the anchor). Input: IsSafeURL("") panics ([:1] cap 0), IsSafeURL(".") panics ([:2] cap 1), IsSafeURL("..") panics ([:3] cap 2), while IsSafeURL("/") returns true. End to end: with input panics. Attacker model: (1) any service rendering untrusted Markdown with the html.Safelink flag (the URL-sanitizing hardening flag itself introduces the crash); or (2) any downstream that calls the exported parser.IsSafeURL on a 0/1/2-byte attacker URL, no flag required. No recover() anywhere, so an uncaught crash of the calling goroutine. ## Verification EXECUTED with negative controls. Direct: the empty/1/2-char cases panic with the exact slice-bounds message while "/" returns true. End to end via ToHTML with html.CommonFlags|html.Safelink: panics, while , , plain text, and (safely dropped) do not. NOT verified: how many downstream apps enable Safelink or call IsSafeURL directly (the default no-Safelink render path does not reach it). ## Suggested fix Move the slice inside the guard: check first, then compute url[:nPath] (or use bytes.HasPrefix(url, path), which is length-safe). One-line change, mirroring the already-correct URIs loop. Also checked and sound: CVE-2026-40890 (smartypants smartLeftAngle OOB) is fixed; CVE-2024-44337 (list/paragraph infinite loop) is fixed (deep nesting capped at

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Debian:12 golang-github-gomarkdown-markdown0.0~git20220731.dcdaee8-2, 0.0~git20231115.a660076-1, 0.0~git20260725.8435af3-1
  • Debian:13 golang-github-gomarkdown-markdown0.0~git20231115.a660076-1, 0.0~git20260725.8435af3-1
  • Debian:14 golang-github-gomarkdown-markdown0 → 0.0~git20260725.8435af3-1
  • Go github.com/gomarkdown/markdown0 → 0.0.0-20260724235538-61af6e1e6971
  • go github.com/gomarkdown/markdown< 0.0.0-20260724235538-61af6e1e6971
  • go github.com/gomarkdown/markdown<0.0.0-20260724235538-61af6e1e6971
  • golang github.comversion unspecified

How to fix CVE-2026-102941

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-102941. EPSS is 0.28%. Act only if a listed version of sync 2026-10-16T15:41:51Z is installed.

Which versions are affected?

Compare what you have installed with 0.0~git20220731.dcdaee8-2, 0.0~git20231115.a660076-1, 0.0~git20260725.8435af3-1, 0.0~git20231115.a660076-1, 0.0~git20260725.8435af3-1, 0 → 0.0~git20260725.8435af3-1, 0 → 0.0.0-20260724235538-61af6e1e6971, < 0.0.0-20260724235538-61af6e1e6971, <0.0.0-20260724235538-61af6e1e6971. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-125: Out-of-bounds Read. EPSS 0.28%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Debian security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    github.com/gomarkdown/markdown fixed in 0.0.0-20260724235538-61af6e1e6971

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    github.com/gomarkdown/markdown fixed in 0.0.0-20260724235538-61af6e1e6971

  3. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ## Summary IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022). ## The

  4. Oct 16, 2026 · GitLab Advisory Database

    Detected

    IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, + so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, + and this is reached end to end when the html.Safelink hardening flag is enabled + and the input contains an empty or very short link destination, giving an unrecoverable + crash DoS. Confirmed at HEAD (e08cff8; present since 2022)." +date: "2

  5. Oct 18, 2026 · Trivy Vulnerability DB

    Fix available

    golang-github-gomarkdown-markdown fixed in 0.0~git20260725.8435af3-1

  6. Oct 18, 2026 · Trivy Vulnerability DB

    Fix available

    golang-github-gomarkdown-markdown fixed in 0.0~git20260725.8435af3-1

  7. Oct 18, 2026 · Trivy Vulnerability DB

    Updated

    The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte d

Sources

  • CVE.orgVulnerability recordCVE-2026-102941

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-102941

    30-day exploitation probability 0.3%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-cv23-7vc5-jfh7

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-102941

    IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022).

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorygo/github.com/gomarkdown/markdown/CVE-2026-102941.yml

    IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, + so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, + and this is reached end to end when the html.Safelink hardening flag is enabled + and the input contains an empty or very short link destination, giving an unrecoverable + crash DoS. Confirmed at HEAD (e08cff8; present since 2022)." +date: "2

    gitlab.com
  • Go Vulnerability DatabasePackage advisoryGHSA-cv23-7vc5-jfh7

    gomarkdown/markdown IsSafeURL panics on short URLs

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-cv23-7vc5-jfh7

    gomarkdown/markdown IsSafeURL panics on short URLs

    osv.dev
  • Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-102941

    The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-b

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.