CVE-2026-40890
Out-of-Bounds Read in gomarkdown/markdown SmartypantsRenderer
Publication date: 2026-04-21
Last updated on: 2026-04-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gomarkdown | markdown | to 2026-04-10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-40890 is an out-of-bounds read vulnerability in the SmartypantsRenderer component of the gomarkdown/markdown Go package. It occurs when processing malformed input containing a '<' character that is not followed by a '>' character anywhere in the remaining text.
The vulnerable function, smartLeftAngle, searches for a closing '>' character in the input slice. If none is found, it attempts to write a slice extending beyond the input length, causing either an out-of-bounds read or a runtime panic due to slice bounds violation.
This can cause the program to crash (panic) when processing such malformed input, leading to a denial of service.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing if the gomarkdown/markdown package's SmartypantsRenderer component panics or crashes when processing malformed input containing a '<' character not followed by a '>' character.
A proof-of-concept test involves running code that processes input such as "<a" through the vulnerable SmartypantsRenderer, which triggers a panic due to an out-of-bounds read.
To detect this on your system, you can create a small Go program that imports the gomarkdown/markdown html package and processes the input "<a" with the SmartypantsRenderer. If the program panics with a slice bounds out of range error, your system is vulnerable.
Example command to compile and run a test program (assuming Go environment is set up):
- Create a file test.go with the provided proof-of-concept code.
- Run `go run test.go`.
If the program panics with a slice bounds out of range error, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the gomarkdown/markdown package to a version that includes the fix committed in commit 759bbc3e32073c3bc4e25969c132fc520eda2778.
This fix prevents the out-of-bounds read by adding a conditional check in the smartLeftAngle function to avoid writing beyond the slice boundary when no closing '>' character is found.
If updating immediately is not possible, avoid processing untrusted or malformed Markdown input that contains '<' characters without matching '>' characters using the vulnerable SmartypantsRenderer.
Monitor your systems for crashes or panics related to slice bounds errors in the markdown processing service as a temporary detection and mitigation measure.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability causes a Denial of Service (DoS) through a panic triggered by processing malformed input, leading to service disruption.
However, the vulnerability does not impact confidentiality or integrity of data, as indicated by the CVSS metrics (Confidentiality: None, Integrity: None).
Therefore, while it may affect availability of services, it does not directly compromise personal data or protected health information, which are critical for compliance with standards like GDPR or HIPAA.
Organizations relying on this package should consider the availability impact in their risk assessments but this vulnerability alone does not imply non-compliance with data protection regulations.
How can this vulnerability impact me? :
This vulnerability can lead to a Denial of Service (DoS) by causing the application using the gomarkdown/markdown package to panic and crash when processing specially crafted malformed input.
Since the vulnerability can be triggered remotely without any privileges or user interaction, an attacker can exploit it over the network to disrupt the availability of the service.
The impact is limited to availability, with no direct effect on confidentiality or integrity.