CVE-2024-44337

Deeper analysis

The package github.com/gomarkdown/markdown, a Go library for parsing Markdown text and rendering it as HTML, contains a denial-of-service vulnerability in versions prior to pseudoversion v0.0.0-20240729232818-a2a9c4f. A logical flaw in the paragraph function within parser/block.go allows specially crafted input to trigger an infinite loop, causing the consuming process to hang and exhaust resources. The issue received a CVSS v3.1 score of 5.1 reflecting local attack vector, low complexity, and limited impact to integrity and availability.

An attacker with the ability to supply Markdown content to an affected application can trigger the loop and induce a persistent denial-of-service condition. Because the library is commonly used to process untrusted user-supplied documents, any program that passes external Markdown through the parser without prior validation or resource limits is exposed.

The fix is contained in commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, which resolves the loop condition in the paragraph parser. Public references consist of the commit itself and a proof-of-concept repository demonstrating the triggering input. The associated EPSS score has remained low, reaching a peak of 0.0521 well after disclosure before receding to the current value of 0.0404.