CVE-2026-35201: 
Ruby vulnerability analysis and mitigation

CVE-2026-35201 is a signed integer length truncation vulnerability in the rdiscount Ruby gem's Markdown parser that causes an out-of-bounds read, enabling unauthenticated remote attackers to crash the host process. It affects rdiscount versions from 1.3.1.1 up to (but not including) 2.2.7.4, and was published on April 6, 2026, with a patch released on April 2, 2026. Microsoft also identified affected packages in Azure Linux (azl3_rubygem-rdiscount_2.2.7.1-1) and CBL-Mariner (cbl2_rubygem-rdiscount_2.2.0.2-3). The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Microsoft MSRC).

The root cause is a signed integer truncation bug (CWE-125: Out-of-bounds Read) in ext/rdiscount.c. At both public entry points (rb_rdiscount_to_html and rb_rdiscount_toc_content), RSTRING_LEN(text) — a long — is passed directly to mkd_string(), which accepts only a signed int for its length parameter. When the input string exceeds INT_MAX (2,147,483,647 bytes), the length truncates to a negative integer; the internal string_stream struct stores this negative value in its int size field, and the read loop (__mkd_io_strget) only terminates when size == 0, so it continues reading past the end of the allocated buffer, causing a segmentation fault. Exploitation requires the attacker to supply a Markdown input larger than ~2 GB to an application that passes attacker-controlled content to RDiscount.new(input).to_html or .toc_content without size validation (GitHub Advisory, Fix Commit).

Successful exploitation results in a reliable denial-of-service by crashing the Ruby process via a native segmentation fault. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Affected deployments are those that parse attacker-controlled Markdown and permit multi-GB inputs without size restrictions, such as web applications or APIs that accept large user-submitted documents (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a standalone Ruby one-liner that constructs a 2.2 GB string and passes it to the vulnerable library, reliably triggering a segmentation fault. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.04%, reflecting low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

1. Identify target: Locate a web application or API endpoint that accepts user-supplied Markdown content and processes it using the rdiscount gem (versions 1.3.1.1 through 2.2.7.3) without input size restrictions.
2. Construct oversized payload: Build a Markdown string exceeding INT_MAX (2,147,483,647 bytes, ~2 GB), for example: s = "a" * 2_200_000_000.
3. Submit payload: Send the oversized string to the target endpoint so it is passed to RDiscount.new(input).to_html or RDiscount.new(input).toc_content.
4. Trigger truncation: The long length value is implicitly truncated to a negative int when passed to mkd_string(), causing the internal size counter to wrap.
5. Achieve crash: The parser's read loop continues past the end of the buffer, triggering a native segmentation fault ([BUG] Segmentation fault) and crashing the Ruby process, resulting in denial of service (GitHub Advisory).

• Logs: Ruby process crash logs containing [BUG] Segmentation fault with a top control frame referencing :to_html or :toc_content; application error logs showing ArgumentError: markdown input too large (on patched versions, indicating attempted exploitation).
• Network: Unusually large HTTP request bodies (>2 GB) submitted to Markdown-rendering endpoints; requests with abnormally high Content-Length headers targeting document or preview APIs.
• Process: Unexpected termination of the Ruby application process without a graceful shutdown; repeated process restarts by a supervisor (e.g., systemd, Puma, Unicorn) in a short time window (GitHub Advisory).

Upgrade rdiscount to version 2.2.7.4 or later, which adds a checked length guard in both rb_rdiscount_to_html and rb_rdiscount_toc_content that raises ArgumentError before calling mkd_string() if the input exceeds INT_MAX. For Microsoft Azure Linux and CBL-Mariner deployments, apply the security update available through the Microsoft Security Response Center. As a short-term workaround, applications should validate and enforce a maximum size limit on Markdown inputs before passing them to rdiscount, preventing oversized payloads from reaching the parser (GitHub Advisory, Fix Commit, Microsoft MSRC).

The vulnerability was reported by researcher WesR and coordinated with maintainer David Foster, resulting in a rapid patch turnaround (fix committed before the advisory was published). Microsoft acknowledged the issue and issued a security update for affected Azure Linux and CBL-Mariner packages. No significant broader media coverage or notable community debate has been observed, consistent with the moderate severity and narrow exploitation preconditions (GitHub Advisory, Microsoft MSRC).