CVE catalog

CVE-2024-44337

golang-github-gomarkdown-markdown: CVE-2024-44337

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.50% · Oct 25, 2026

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-gomarkdown-markdownsid0.0~git20260725.8435af3-1fixed
Debiangolang-github-gomarkdown-markdownforky0.0~git20260725.8435af3-1fixed
Debiangolang-github-gomarkdown-markdowntrixie0.0~git20231115.a660076-1vulnerable
Debiangolang-github-gomarkdown-markdownbookworm0.0~git20220731.dcdaee8-2vulnerable
Opensusefqtumbleweed0.14.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-gomarkdown-markdownsourcesid0.0~git20260725.8435af3-1not yet assignedNot reported[1085377]
Debiangolang-github-gomarkdown-markdownsourceforky0.0~git20260725.8435af3-1not yet assignedNot reported[1085377]
Debiangolang-github-gomarkdown-markdownsourcetrixie(unfixed)not yet assignedNot reported[1085377]
Debiangolang-github-gomarkdown-markdownsourcebookworm(unfixed)not yet assignedNot reported[1085377]
Opensusefqrpmtumbleweed0.14.0-1.1Not reportedOPENSUSE-SU-2025:14753-1Not reported

[Debian bug #1085377]

Notes

[trixie] golang-github-gomarkdown-markdown: Minor issue [bookworm] golang-github-gomarkdown-markdown: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-gomarkdown-markdown-dev]Affected

    Source package: [golang-github-gomarkdown-markdown]

    Details (2)

    • 0.0~git20220731.dcdaee8-2 · all · bookworm

      Affected

      dsa · golang-github-gomarkdown-markdown · debian · bookworm; dsa · golang-github-gomarkdown-markdown · debian · 12

    • 0.0~git20220731.dcdaee8-2 · all · bookworm

      Affected

      dsa · golang-github-gomarkdown-markdown · debian · bookworm; dsa · golang-github-gomarkdown-markdown · debian · 12

[Debian 13 (Trixie)]

[openSUSE Tumbleweed]

  • [fq]Fixed

    Source package: [fq]

    Details (1)

    • 0.17.0-1.6 · x86_64 · tumbleweed

      Fixed · Fixed: 0.14.0-1.1

      dsa · fq · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]