CVE-2026-35201: rdiscount has an Out-of-bounds Read
(updated )
A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process
References
- github.com/advisories/GHSA-6r34-94wq-jhrc
- github.com/davidfstr/rdiscount/commit/b1a16445e92e0d12c07594dedcdc56f80b317761
- github.com/davidfstr/rdiscount/security/advisories/GHSA-6r34-94wq-jhrc
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rdiscount/CVE-2026-35201.yml
- nvd.nist.gov/vuln/detail/CVE-2026-35201
Code Behaviors & Features
Detect and mitigate CVE-2026-35201 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →