CVE catalog

CVE-2026-40890

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > characte

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.35% · Oct 25, 2026

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-gomarkdown-markdownsid0.0~git20260725.8435af3-1fixed
Debiangolang-github-gomarkdown-markdownforky0.0~git20260725.8435af3-1fixed
Debiangolang-github-gomarkdown-markdowntrixie0.0~git20231115.a660076-1vulnerable
Debiangolang-github-gomarkdown-markdownbookworm0.0~git20220731.dcdaee8-2vulnerable
Cpegolang-github-gomarkdown-markdownNot reportedNot reportedvulnerable
CpemarkdownNot reported2026-04-10fixed
Gogithub.com/gomarkdown/markdownNot reported0.0.0-20260411013819-759bbc3e3207fixed
CpemarkdownNot reported2026-04-10fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-gomarkdown-markdownsourcesid0.0~git20260725.8435af3-1not yet assignedNot reported[1134644]
Debiangolang-github-gomarkdown-markdownsourceforky0.0~git20260725.8435af3-1not yet assignedNot reported[1134644]
Debiangolang-github-gomarkdown-markdownsourcetrixie(unfixed)not yet assignedNot reported[1134644]
Debiangolang-github-gomarkdown-markdownsourcebookworm(unfixed)not yet assignedNot reported[1134644]
CpemarkdowncpeNot reported2026-04-10Not reportedNot reportedNot reported
Gogithub.com/gomarkdown/markdownGoNot reported0.0.0-20260411013819-759bbc3e3207Not reportedNot reportedNot reported
CpemarkdowncpeNot reported2026-04-10Not reportedNVD-CVE-2026-40890Not reported

[Debian bug #1134644]

Notes

[trixie] golang-github-gomarkdown-markdown: Minor issue [bookworm] golang-github-gomarkdown-markdown: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-gomarkdown-markdown-dev]Affected

    Source package: [golang-github-gomarkdown-markdown]

    Details (2)

    • 0.0~git20220731.dcdaee8-2 · all · bookworm

      Affected

      nvd · golang-github-gomarkdown-markdown · debian · bookworm; nvd · golang-github-gomarkdown-markdown · debian · 12

    • 0.0~git20220731.dcdaee8-2 · all · bookworm

      Affected

      nvd · golang-github-gomarkdown-markdown · debian · bookworm; nvd · golang-github-gomarkdown-markdown · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]