CVE-2026-40890: Github.com/gomarkdown/markdown Go Markdown Has An Out-of-bounds Vulnerability
HIGHCVE-2026-40890 is a HIGH (CVSS 7.5) go markdown has an out-of-bounds vulnerability (CWE-125: Out-of-bounds Read) affecting Github.com/gomarkdown/markdown libraries in the Go ecosystem. The issue involves go markdown has an out-of-bounds read in smartypantsrenderer. Remediation is available by upgrading affected packages to version 0.0.0-20260411013819-759bbc3e3207.
CVE-2026-40890 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix CVE-2026-40890
To remediate this vulnerability, upgrade all affected Github.com/gomarkdown/markdown dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/gomarkdown/markdown to 0.0.0-20260411013819-759bbc3e3207Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/gomarkdown/markdownHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-40890, inspect your project dependencies for Github.com/gomarkdown/markdown:
inspect dependencies for github.com/gomarkdown/markdownAnalyze the terminal output to locate any version of Github.com/gomarkdown/markdown in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20260411013819-759bbc3e3207), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In Github.com/gomarkdown/markdown, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-40890 Affected Github.com/gomarkdown/markdown Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/gomarkdown/markdown
|
Go |
< 0.0.0-20260411013819-759bbc3e3207
|
0.0.0-20260411013819-759bbc3e3207
|
References
Frequently Asked Questions
What is CVE-2026-40890?
Which Github.com/gomarkdown/markdown versions are affected?
What version fixes CVE-2026-40890?
Is github.com/gomarkdown/markdown affected?
What is the CVSS score of CVE-2026-40890?
What CWE is associated with CVE-2026-40890?
How can I check Go dependencies for CVE-2026-40890?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-77fj-vx54-gvh7",
"modified" : "2026-04-27T16:17:20Z",
"published" : "2026-04-14T22:38:20Z",
"aliases" : [ "CVE-2026-40890" ],
"summary" : "Go Markdown has an Out-of-bounds Read in SmartypantsRenderer",
"details" : "### Summary\n\nProcessing a malformed input containing a `<` character that is not followed by a `>` character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic.\n\n### Details\n\nThe `smartLeftAngle()` function in `html/smartypants.go:367-376` performs an out-of-bounds slice operation when processing a `<` character that is not followed by a `>` character anywhere in the remaining text.\nhttps://github.com/gomarkdown/markdown/blob/37c66b85d6ab025ba67a73ba03b7f3ef55859cca/html/smartypants.go#L367-L376\nIf the length of the slice is lower than its capacity, this leads to an extra byte of data read. If the length equals the capacity, this leads to a panic.\n\n### PoC\n```golang\npackage main\n\nimport (\n\t\"bytes\"\n\t\"fmt\"\n\n\t\"github.com/gomarkdown/markdown/html\"\n)\n\nfunc main() {\n\tsrc := []byte(\"<a\")\n\n\tfmt.Printf(\"Input: %q (len=%d, cap=%d)\\n\", src, len(src), cap(src))\n\n\tvar buf bytes.Buffer\n\tsp := html.NewSmartypantsRenderer(html.Smartypants)\n\tsp.Process(&buf, src) // panics: slice bounds out of range\n\n\tfmt.Printf(\"Output: %q\\n\", buf.String())\n}\n```\n\n### Impact\nThis vulnerability will lead to a Denial of Service / panic on the processing service.\n\n\n-- The Datadog Security Team",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/gomarkdown/markdown"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.0.0-20260411013819-759bbc3e3207"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40890"
}, {
"type" : "WEB",
"url" : "https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/gomarkdown/markdown"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-125" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-04-14T22:38:20Z",
"nvd_published_at" : "2026-04-21T20:17:02Z"
}
}