GCVE - cpe:2.3:a:gomarkdown:markdown:-:*:*:*:*:go:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gomarkdown:markdown:-:*:*:*:*:go:*:*

part: a version: - update: *

Notes

Imported from NVD CPE 2.0 feed

PURL	Source	Last updated
`pkg:github/gomarkdown/markdown`	purl2cpe	2026-06-01 10:13:24.643238
`pkg:golang/github.com/gomarkdown/markdown`	purl2cpe	2026-06-01 10:13:24.643240

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-42821`	vulnerable	2026-06-08 06:11:09.559624	github.com/gomarkdown/markdown Out-of-bounds Read while parsing citations HIGH (7.5) The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `0.0.0-20230922105210-14b16010c2ee`, which corresponds with commit `14b16010c2ee7ff33a940a541d993bd043a88940`, parsing malformed markdown input with parser that uses parser.Mmark extension could result in out-of-bounds read vulnerability. To exploit the vulnerability, parser needs to have `parser.Mmark` extension set. The panic occurs inside the `citation.go` file on the line 69 when the parser tries to access the element past its length. This can result in a denial of service. Commit `14b16010c2ee7ff33a940a541d993bd043a88940`/pseudoversion `0.0.0-20230922105210-14b16010c2ee` contains a patch for this issue. Published: 2023-09-22T16:55:33.355Z Updated: 2024-09-24T19:27:42.779Z Open on db.gcve.eu Reference links https://github.com/gomarkdown/markdown/security/advisories/GHSA-m9xq-6h2j-65r2 https://github.com/gomarkdown/markdown/commit/14b16010c2ee7ff33a940a541d993bd043a88940 https://github.com/gomarkdown/markdown/blob/7478c230c7cd3e7328803d89abe591d0b61c41e4/parser/citation.go#L69	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.