CVE-2026-102941: 
Wolfi vulnerability analysis and mitigation

CVE-2026-102941 is a denial-of-service vulnerability in the gomarkdown/markdown Go library caused by an out-of-bounds slice operation in the parser.IsSafeURL function. The flaw was originally discovered and reported by researcher arpitjain099, first published to the GitHub Advisory Database on July 25, 2026, and formally disclosed on October 16, 2026. All versions of github.com/gomarkdown/markdown prior to 0.0.0-20260724235538-61af6e1e6971 are affected; the vulnerability has been present since 2022. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is an improper ordering of a slice operation and its bounds guard in parser/parser.go within the IsSafeURL function (CWE-125: Out-of-bounds Read). The code evaluates url[:nPath] on line 789 before the nLink >= nPath length check on line 790; when len(url) < nPath and cap(url) < nPath, Go's runtime raises an unrecoverable slice-bounds panic. This affects only the relative-path prefix loop (/, ./, ../) — the adjacent URI scheme loop is already correctly guarded. The panic is reachable via two attack surfaces: (1) calling markdown.ToHTML with the html.Safelink flag enabled on Markdown containing an empty or very short link destination (e.g., [x]()), or (2) directly passing a 0-, 1-, or 2-byte attacker-controlled URL to the exported parser.IsSafeURL function. Because no recover() is present, the panic terminates the calling goroutine without the possibility of graceful error handling (GitHub Advisory, Fix Commit).

Successful exploitation causes an unrecoverable process crash (denial of service) in any Go application that renders untrusted Markdown using the html.Safelink flag or that passes short attacker-controlled URLs to parser.IsSafeURL. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. Services such as documentation platforms, comment systems, or API gateways that process user-supplied Markdown are at risk of complete service disruption from a single malformed input (GitHub Advisory).

No public proof-of-concept exploit code or exploit kit integration has been identified, and there is no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, exploitation requires no authentication, no privileges, and no user interaction — a single HTTP request containing a crafted Markdown payload (e.g., [x]()) is sufficient to trigger the panic in a vulnerable service (GitHub Advisory, Feedly).

1. Reconnaissance: Identify services that accept and render user-supplied Markdown using the gomarkdown/markdown Go library with the html.Safelink flag enabled (e.g., documentation sites, wikis, comment systems, or REST APIs that return rendered HTML).
2. Craft malicious payload: Prepare a Markdown document containing an empty or very short link destination, such as [x](), [x](.), or [x](..). These inputs produce 0-, 1-, or 2-byte URL byte slices that trigger the panic.
3. Submit payload: Send the crafted Markdown to the target service via any available input channel (e.g., HTTP POST body, form field, API endpoint).
4. Trigger panic: The server-side markdown.ToHTML call invokes IsSafeURL, which attempts url[:nPath] on the short URL before the length guard, causing a slice-bounds panic that crashes the calling goroutine.
5. Achieve denial of service: Because no recover() is present, the goroutine terminates unrecoverably. Depending on the application's architecture, this may crash the entire process or render the service unavailable (GitHub Advisory, Fix Commit).

• Logs: Application logs showing Go runtime panic messages such as runtime error: slice bounds out of range [:N] with capacity M originating from parser/parser.go in the IsSafeURL function; sudden process exit or goroutine crash entries in service logs.
• Network: Repeated HTTP requests to Markdown-rendering endpoints containing link syntax with empty or minimal destinations (e.g., [x](), [x](.), [x](..)); a spike in 500-series error responses or connection resets from the affected service following such requests.
• Process: Unexpected termination of the Go application process; crash dump files or core dumps generated by the Go runtime following a slice-bounds panic.

Upgrade github.com/gomarkdown/markdown to version 0.0.0-20260724235538-61af6e1e6971 or later, which fixes the issue by moving the url[:nPath] slice operation inside the nLink >= nPath length guard in IsSafeURL (Fix Commit). As a temporary workaround for services that cannot immediately upgrade, consider disabling the html.Safelink flag (note: this removes URL sanitization hardening) or validating that link destinations are at least 3 bytes long before passing them to the library. Applications that call parser.IsSafeURL directly should add their own length pre-check (len(url) >= 3) before invoking the function (GitHub Advisory).