{"id":"ghsa-ghsa-cv23-7vc5-jfh7","seq":2459,"kind":"advisory","title":"gomarkdown/markdown IsSafeURL panics on short URLs","url":"https://github.com/advisories/GHSA-cv23-7vc5-jfh7","permalink":"https://vulnpulse.app/items/ghsa-ghsa-cv23-7vc5-jfh7","summary":"影響: go:github.com/gomarkdown/markdown < 0.0.0-20260724235538-61af6e1e6971 → 0.0.0-20260724235538-61af6e1e6971\nSummary IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022). The defect parser/parser.go, IsSafeURL: go func IsSafeURL(url []byte) bool { nLink := len(url) for _, path :=…","severity":"high","techs":["go","github"],"cves":["CVE-2026-102941"],"tags":["GHSA-cv23-7vc5-jfh7","github.com/gomarkdown/markdown"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-16T15:41:39.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}