High-Severity Go Markdown Parser Bug: CVE-2026-40890

The National Vulnerability Database has detailed CVE-2026-40890, a high-severity vulnerability (CVSS 7.5) affecting the github.com/gomarkdown/markdown Go library. This library is widely used for parsing Markdown and rendering it as HTML. The flaw arises when processing malformed input containing an unclosed < character, which can lead to an Out-of-Bounds read or application panic within the SmartypantsRenderer.

This isn’t a theoretical issue; it’s a direct denial-of-service vector and could potentially lead to information disclosure. An attacker can craft a specific Markdown input that, when processed by an application using the vulnerable library, crashes the service or leaks memory contents. The simplicity of the trigger—a single malformed character sequence—makes exploitation straightforward.

Defenders must prioritize patching. The National Vulnerability Database confirms this vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778. Any system or application leveraging github.com/gomarkdown/markdown needs an immediate upgrade to a patched version to mitigate this risk. Ignoring it leaves a clear path for attackers to disrupt services.