CVE-2026-102941: gomarkdown/markdown IsSafeURL panics on short URLs

October 16, 2026

IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022).

References

github.com/advisories/GHSA-cv23-7vc5-jfh7
github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9
github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7
nvd.nist.gov/vuln/detail/CVE-2026-102941

Code Behaviors & Features

Detect and mitigate CVE-2026-102941 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →