Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/gomarkdown/markdown
  4. ›
  5. CVE-2024-44337

CVE-2024-44337: Infinite loop in github.com/gomarkdown/markdown

October 15, 2024 (updated December 12, 2024)

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.

References

  • github.com/Brinmon/CVE-2024-44337
  • github.com/advisories/GHSA-xhr3-wf7j-h255
  • github.com/gomarkdown/markdown
  • github.com/gomarkdown/markdown/commit/a2a9c4f76ef5a5c32108e36f7c47f8d310322252
  • nvd.nist.gov/vuln/detail/CVE-2024-44337
  • pkg.go.dev/vuln/GO-2024-3205

Code Behaviors & Features

Detect and mitigate CVE-2024-44337 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 0.0.0-20240729212818-a2a9c4f76ef5

Fixed versions

  • 0.0.0-20240729212818-a2a9c4f76ef5

Solution

Upgrade to version 0.0.0-20240729212818-a2a9c4f76ef5 or above.

Impact 5.1 MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Learn more about CVSS

Weakness

  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

Source file

go/github.com/gomarkdown/markdown/CVE-2024-44337.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:12 +0000.