HIGH 7.5 GitHub
CVE-2026-102941
gomarkdown/markdown IsSafeURL panics on short URLs
## Summary
IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022).
## The defect
parser/parser.go, IsSafeURL:
```go
func IsSafeURL(url []byte) bool {
nLink := len(url
Affected Products
- go/github.com/gomarkdown/markdown < 0.0.0-20260724235538-61af6e1e6971
References
- https://github.com/advisories/GHSA-cv23-7vc5-jfh7
- https://github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7
- https://github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9
- https://github.com/advisories/GHSA-cv23-7vc5-jfh7
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-10-16 via GitHub. Affected: go/github.com/gomarkdown/markdown < 0.0.0-20260724235538-61af6e1e6971.
vulnfeed aggregates 16278 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.