github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer
Priority HIGH 72CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-125 and the CVSS impact.
Summary
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed markdown (gomarkdown): 759bbc3e32073c3bc4e25969c132fc520eda2778github.com/gomarkdown/markdown (Go): 0.0.0-20260411013819-759bbc3e3207Red Hat: 5 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gomarkdown | markdown | before 759bbc3e32073c3bc4e25969c132fc520eda2778 | 759bbc3e32073c3bc4e25969c132fc520eda2778 | Patch available | CNA |
| — | github.com/gomarkdown/markdown (Go) | before 0.0.0-20260411013819-759bbc3e3207 | 0.0.0-20260411013819-759bbc3e3207 | Patch available | GHSA-77fj-vx54-gvh7 |
- markdown Vendorgomarkdown Affected before 759bbc3e32073c3bc4e25969c132fc520eda2778 Fixed in 759bbc3e32073c3bc4e25969c132fc520eda2778 Patch available CNA
- github.com/gomarkdown/markdown (Go) Vendor— Affected before 0.0.0-20260411013819-759bbc3e3207 Fixed in 0.0.0-20260411013819-759bbc3e3207 Patch available GHSA-77fj-vx54-gvh7
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gomarkdown:markdown:*:*:*:*:*:go:*:* | before 2026-04-10 | Vulnerable | gomarkdown |
- cpe:2.3:a:gomarkdown:markdown:*:*:*:*:*:go:*:* Versions before 2026-04-10 Vulnerable ·gomarkdown
Remediation
- Fix · CNA markdown (gomarkdown) Fixed in 759bbc3e32073c3bc4e25969c132fc520eda2778
- Fix · GHSA-77fj-vx54-gvh7 github.com/gomarkdown/markdown (Go) Fixed in 0.0.0-20260411013819-759bbc3e3207 Advisory →
Red Hat 5 advisories
- RHSA-2026:24539 Released 2026-06-08 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.15.3 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9
- RHSA-2026:24503 Released 2026-06-08 · Red Hat rating ImportantMulticluster Global Hub 1.7.1 security update
- Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
- RHSA-2026:23345 Released 2026-06-04 · Red Hat rating ImportantMulticluster Global Hub 1.6.2 security update
- Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
Show 2 more Red Hat advisories
- RHSA-2026:22347 Released 2026-06-01 · Red Hat rating ImportantMulticluster Global Hub 1.4.5 security update
- Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:21769 Released 2026-05-28 · Red Hat rating ImportantMulticluster Global Hub 1.5.4 security update
- Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Multicluster Global Hub 1.4.9 | Fixed | RHSA-2026:22347 |
| Multicluster Global Hub 1.6.5 | Fixed | RHSA-2026:23345 |
| Multicluster Global Hub 1.7.3 | Fixed | RHSA-2026:24503 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 | Fixed | RHSA-2026:24539 |
| Red Hat multicluster global hub 1.5.3 | Fixed | RHSA-2026:21769 |
Not affected: 6 products
- Kube Descheduler Operator
- Multicluster Global Hub 1.4.9
- Multicluster Global Hub 1.6.5
- Multicluster Global Hub 1.7.3
- Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat multicluster global hub 1.5.3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40890
- 2026-10-03 Alias added: GHSA-77fj-vx54-gvh7
References
More gomarkdown Markdown vulnerabilities
- TI-2023-22912 github.com/gomarkdown/markdown Out-of-bounds Read while parsing citations CVSS 3.1HIGH 7.5
Sources
- CVE-2026-40890 · CVE Program
- CVE-2026-40890 · NVD
- FIRST EPSS
- GHSA-77fj-vx54-gvh7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-40890 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences