CVE-2026-41680
published 2026-04-24CVE-2026-41680: Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.51%
42.6th percentile
Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | automation-portal | — | — |
| apicurio | apicurio-registry-ui-rhel8 | — | — |
| apicurio | apicurio-registry-ui-rhel9 | — | — |
| apicurio | apicurio-studio-ui-rhel8 | — | — |
| grafana | grafana | — | — |
| marked_project | marked | — | — |
| marked_project | marked | >= 18.0.0 < 18.0.2 | 18.0.2 |
| marked_project | marked | >= 18.0.0 < 18.0.2 | 18.0.2 |
| markedjs | marked | — | — |
| migration-toolkit-virtualization | mtv-console-plugin-rhel9 | — | — |
| openshift-gitops-1 | argocd-rhel8 | — | — |
| openshift-gitops-1 | argocd-rhel9 | — | — |
| openshift4 | ose-console-rhel9 | — | — |
| openshift4 | ose-monitoring-plugin-rhel9 | — | — |
| rhceph | alloy-rhel10 | — | — |
| rhdesktop | rh-podman-desktop-ext-bootc-rhel10 | — | — |
| rhoai | odh-dashboard-rhel9 | — | — |
| rhoai | odh-mod-arch-maas-rhel9 | — | — |
| rhoai | odh-mod-arch-model-registry-rhel9 | — | — |
| satellite | iop-advisor-frontend-rhel9 | — | — |
| satellite | iop-vulnerability-frontend-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
ghsa·2026-04-29
CVE-2026-41680 [HIGH] CWE-400 Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
### Summary
A critical Denial of Service (DoS) vulnerability exists in `[email protected]`. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (`\x09\x0b\n`)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM).
### Details
The vulnerability originates in how `marked`'s block tokenizer handles unexpected whitespace characters.
1. **Tab Character (`\x09`) Consumption**: The `space()` tokenizer matches standard whitespace using the regex `/^(?:[ \t]*(?:\n|$))+/`. When parsing the malicious payload (`\x09\x0b\n`), this rule successfu
VulDB
markedjs marked up to 18.0.1 resource consumption (GHSA-6v9c-7cg6-27q7)
vuldb·2026-04-24·CVSS 8.7
CVE-2026-41680 [HIGH] markedjs marked up to 18.0.1 resource consumption (GHSA-6v9c-7cg6-27q7)
A vulnerability was found in markedjs marked up to 18.0.1. It has been declared as problematic. Affected is an unknown function. Executing a manipulation can lead to resource consumption.
This vulnerability is tracked as CVE-2026-41680. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
Red Hat
marked: Marked: Denial of Service via specific input sequence
vendor_redhat·2026-04-24·CVSS 8.7
CVE-2026-41680 [HIGH] CWE-835 marked: Marked: Denial of Service via specific input sequence
marked: Marked: Denial of Service via specific input sequence
A flaw was found in marked, a markdown parser and compiler. An unauthenticated attacker can exploit this Denial of Service (DoS) vulnerability by providing a specific 3-byte input sequence (a tab, a vertical tab, and a newline). This input triggers an infinite recursion loop during parsing, leading to unbounded memory allocation and causing the host Node.js application to crash due to Memory Exhaustion (OOM).
Mitigation: To mitigate this vulnerability, Red Hat products that utilize the 'marked' library should be configured to process markdown content only from trusted sources. If markdown rendering is not a critical function, consider disabling or restricting its use within the application's configuration to reduce exposure.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-41680 python-nbclassic: Marked: Denial of Service via specific input sequence [fedora-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 python-nbclassic: Marked: Denial of Service via specific input sequence [fedora-all]
CVE-2026-41680 python-nbclassic: Marked: Denial of Service via specific input sequence [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 grafana: Marked: Denial of Service via specific input sequence [fedora-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 grafana: Marked: Denial of Service via specific input sequence [fedora-all]
CVE-2026-41680 grafana: Marked: Denial of Service via specific input sequence [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 python-jupytext: Marked: Denial of Service via specific input sequence [fedora-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 python-jupytext: Marked: Denial of Service via specific input sequence [fedora-all]
CVE-2026-41680 python-jupytext: Marked: Denial of Service via specific input sequence [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 marked: Marked: Denial of Service via specific input sequence [fedora-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 marked: Marked: Denial of Service via specific input sequence [fedora-all]
CVE-2026-41680 marked: Marked: Denial of Service via specific input sequence [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 golang-github-apache-beam-2: Marked: Denial of Service via specific input sequence [fedora-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 golang-github-apache-beam-2: Marked: Denial of Service via specific input sequence [fedora-all]
CVE-2026-41680 golang-github-apache-beam-2: Marked: Denial of Service via specific input sequence [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 python-ipyparallel: Marked: Denial of Service via specific input sequence [epel-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 python-ipyparallel: Marked: Denial of Service via specific input sequence [epel-all]
CVE-2026-41680 python-ipyparallel: Marked: Denial of Service via specific input sequence [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 marked: Marked: Denial of Service via specific input sequence [epel-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 marked: Marked: Denial of Service via specific input sequence [epel-all]
CVE-2026-41680 marked: Marked: Denial of Service via specific input sequence [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 forgejo: Marked: Denial of Service via specific input sequence [epel-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 forgejo: Marked: Denial of Service via specific input sequence [epel-all]
CVE-2026-41680 forgejo: Marked: Denial of Service via specific input sequence [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 python-ipyparallel: Marked: Denial of Service via specific input sequence [fedora-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 python-ipyparallel: Marked: Denial of Service via specific input sequence [fedora-all]
CVE-2026-41680 python-ipyparallel: Marked: Denial of Service via specific input sequence [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 jupyterlab: Marked: Denial of Service via specific input sequence [fedora-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 jupyterlab: Marked: Denial of Service via specific input sequence [fedora-all]
CVE-2026-41680 jupyterlab: Marked: Denial of Service via specific input sequence [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 forgejo: Marked: Denial of Service via specific input sequence [fedora-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 forgejo: Marked: Denial of Service via specific input sequence [fedora-all]
CVE-2026-41680 forgejo: Marked: Denial of Service via specific input sequence [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 jupyterlab: Marked: Denial of Service via specific input sequence [epel-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 jupyterlab: Marked: Denial of Service via specific input sequence [epel-all]
CVE-2026-41680 jupyterlab: Marked: Denial of Service via specific input sequence [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 cldr-emoji-annotation: Marked: Denial of Service via specific input sequence [fedora-all]
bugzilla·2026-04-25·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 cldr-emoji-annotation: Marked: Denial of Service via specific input sequence [fedora-all]
CVE-2026-41680 cldr-emoji-annotation: Marked: Denial of Service via specific input sequence [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41680 marked: Marked: Denial of Service via specific input sequence
bugzilla·2026-04-24·CVSS 8.7
CVE-2026-41680 [HIGH] CVE-2026-41680 marked: Marked: Denial of Service via specific input sequence
CVE-2026-41680 marked: Marked: Denial of Service via specific input sequence
Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.
2026-04-24
Published