Description
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gomarkdown | markdown | < 759bbc3e32073c3bc4e25969c132fc520eda2778 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-gomarkdown-markdown | 0.0~git20260725.8435af3-1 | — |
| Debian 13 | golang-github-gomarkdown-markdown | No fix yet | — |
| Debian 12 | golang-github-gomarkdown-markdown | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-gomarkdown-markdown | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-gomarkdown-markdown | No fix yet | — |
| Ubuntu 25.10 | golang-github-gomarkdown-markdown | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-gomarkdown-markdown | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 | openSUSE-SU-2026:21551-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | fq | 0.17.0-r4 | — |
| Wolfi rolling | kube-metrics-adapter | 0.2.8-r8 | — |
| Wolfi rolling | snyk-cli | 1.1304.0-r1 | — |
| Wolfi rolling | temporal | 1.7.0-r1 | — |
| Wolfi rolling | temporal-ui-server | 2.48.3-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/gomarkdown/markdown | < 0.0.0-20260411013819-759bbc3e3207 | 0.0.0-20260411013819-759bbc3e3207 | GHSA-77fj-vx54-gvh7 |
Advisories 3
- SUSE-SU-2026:23227-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 27, 2026
- SUSE-SU-2026:23216-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:21551-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Aug 12, 2026