github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer
CVE-2026-40890 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-40890, released April 21, 2026. It is not reported as exploited. Patch Radar priority: High.
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| golang-github-gomarkdown-markdown · Debian 14 | 0.0~git20260725.8435af3-1 | DEBIAN-CVE-2026-40890 | Apr 21, 2026 |
| govulncheck-vulndb · opensuse-leap 16.0 | 0.0.20260727T201416-160000.1.1 | OPENSUSE-SU-2026:21551-1 | Aug 10, 2026 |
| govulncheck-vulndb · sles 16.0 | 0.0.20260727T201416-160000.1.1 | SUSE-SU-2026:23227-1 | Aug 10, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.