Every CVE Search/ Get API key

CVE-2024-44337

Infinite loop in github.com/gomarkdown/markdown

5.1 MediumPublic exploitFix available

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.50%Up 0.5 points since Oct 16, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.1

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.

Record
CVE-2024-44337
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
EUVDEUVD-2024-3169 5.1

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.

Record
EUVD-2024-3169
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-xhr3-wf7j-h255 6.9

Infinite loop in github.com/gomarkdown/markdown

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.

Record
GHSA-xhr3-wf7j-h255
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-835
Updated
2026-11-02
NVD 5.1

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.

Record
CVE-2024-44337
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSV 5.1

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.

Record
CVE-2024-44337
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-03
OSVDEBIAN-CVE-2024-44337 5.1

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.

Record
DEBIAN-CVE-2024-44337
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-xhr3-wf7j-h255 6.9

Infinite loop in github.com/gomarkdown/markdown

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.

Record
GHSA-xhr3-wf7j-h255
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-835
Updated
2026-11-02
OSVUBUNTU-CVE-2024-44337 5.1

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.

Record
UBUNTU-CVE-2024-44337
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVAZL-50618 No score

CVE-2024-44337 affecting package cri-o for versions less than 1.22.3-12

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.

Record
AZL-50618
Updated
2026-11-02
OSVGO-2024-3205 No score

Infinite loop in github.com/gomarkdown/markdown

Infinite loop in github.com/gomarkdown/markdown

Record
GO-2024-3205
Updated
2026-11-02
OSVopenSUSE-SU-2024:14599-1 No score

govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20241213T205935-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14599-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14753-1 No score

fq-0.14.0-1.1 on GA media

These are all security issues fixed in the fq-0.14.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14753-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
github.com/gomarkdown/markdown
Go
before 0.0.0-20240729212818-a2a9c4f76ef5
0.0.0-20240729212818-a2a9c4f76ef5
cri-o
Azure Linux:2
before 1.22.3-12
1.22.3-12
golang-github-gomarkdown-markdown
Debian:12
All versions, plus listed versions
0.0~git20220731.dcdaee8-20.0~git20231115.a660076-10.0~git20260725.8435af3-1
None known
golang-github-gomarkdown-markdown
Debian:13
All versions, plus listed versions
0.0~git20231115.a660076-10.0~git20260725.8435af3-1
None known
golang-github-gomarkdown-markdown
Debian:14
before 0.0~git20260725.8435af3-1, plus listed versions
0.0~git20231115.a660076-1
0.0~git20260725.8435af3-1
golang-github-gomarkdown-markdown
Ubuntu:24.04:LTS
All versions, plus listed versions
0.0~git20220731.dcdaee8-20.0~git20231115.a660076-1
None known
golang-github-gomarkdown-markdown
Ubuntu:25.10
All versions, plus listed versions
0.0~git20231115.a660076-1
None known
golang-github-gomarkdown-markdown
Ubuntu:26.10
All versions, plus listed versions
0.0~git20231115.a660076-10.0~git20260725.8435af3-1
None known
golang-github-gomarkdown-markdown
Ubuntu:26.04:LTS
All versions, plus listed versions
0.0~git20231115.a660076-1
None known
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
before 0.0.20241213T205935-1.1
0.0.20241213T205935-1.1
fq
openSUSE:Tumbleweed
before 0.14.0-1.1
0.14.0-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubBrinmon/CVE-2024-443372024-10-15

History

History
RecordedChangedSources
affected, factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-44337 is a medium vulnerability (CVSS 5.1) in github.com/gomarkdown/markdown, published October 15, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in github.com/gomarkdown/markdown 0.0.0-20240729212818-a2a9c4f76ef5.

References

Show 27 moreShow less
MoveEnter Open