CVE-2026-102941 gomarkdown CVE debrief

Who should care

Defenders responsible for systems that use the gomarkdown/markdown package and process untrusted input should prioritize patching or mitigating this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security and stability of their systems. Systems that use the gomarkdown/markdown package and process untrusted input are at risk of a DoS attack, which could lead to and

Why it matters

Defenders should prioritize patching or mitigating CVE-2026-102941, as it allows for a panic when the IsSafeURL function is called with a short URL, potentially leading to a DoS attack. Systems that use the gomarkdown/markdown package and process untrusted input are at risk.

• Potential denial-of-service (DoS) attacks
• System crashes or instability due to unhandled panics
• Increased risk of exploitation due to publicly available information

Technical summary

The IsSafeURL function in the gomarkdown/markdown package panics when called with a short URL, potentially leading to a DoS attack. This is caused by slicing the URL before checking its length, leading to a panic when the URL is shorter than the path prefix. The vulnerability is reachable end-to-end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination. The issue is confined to the relative-path loop in the IsSafeURL function, while the adjacent URIs loop is already correctly guarded.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems that use the gomarkdown/markdown package and process untrusted input.

Recommended defensive actions

• Patch or update the gomarkdown/markdown package to a fixed version
• Implement input validation and sanitization for URLs processed by the IsSafeURL function
• Monitor systems that use the gomarkdown/markdown package for potential DoS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the IsSafeURL function slicing the URL before checking its length, leading to a panic when the URL is shorter than the path prefix. This is reachable end-to-end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.