The gomarkdown/markdown library is vulnerable to an out of bounds read flaw, which can lead to service disruption via application crashes.

This vulnerability is an out of bounds read (CWE-125) occurring when the SmartypantsRenderer processes malformed input containing an unclosed angle bracket. This flaw is exploitable by an unauthenticated attacker who can supply malicious text to the parser.

The primary impact of this vulnerability is a potential denial of service, as the out of bounds read may trigger an application panic. With a CVSS score of 7.5, this represents a high severity risk that could lead to significant downtime for applications relying on this library to process user-provided content.

Immediate Action: Update the gomarkdown/markdown dependency to version 0.0.0-20260411013819-759bbc3e3207 or newer to incorporate the fix provided in commit 759bbc3e32073c3bc4e25969c132fc520eda2778.

Proactive Monitoring: Monitor application logs for unexpected panic events or service restarts originating from components that handle Markdown parsing.

Compensating Controls: Implement input validation or sanitization layers to filter malformed Markdown strings before they reach the rendering engine.

Public Exploit Available: Unknown

Given the potential for service instability and the existence of a proof-of-concept, organizations using the gomarkdown/markdown library should prioritize this update within their standard patch cycle. Ensure all downstream services are recompiled with the updated library version to mitigate the risk of denial of service attacks.