CVE-2026-35201: Discount Markdown Buffer Overflow Flaw

CVE-2026-35201 Overview

CVE-2026-35201 is an Out-of-Bounds Read vulnerability affecting Discount, a C implementation of John Gruber's Markdown markup language. A signed length truncation bug in the default Markdown parse path allows inputs larger than INT_MAX to be truncated to a signed int before entering the native parser. This enables an attacker to cause the parser to read past the end of the supplied buffer, resulting in a process crash and potential denial of service.

Critical Impact

Attackers can exploit this vulnerability to crash applications using affected Discount library versions by supplying specially crafted Markdown inputs larger than INT_MAX, causing denial of service conditions.

Affected Products

• Discount Markdown library versions 1.3.1.1 to before 2.2.7.4
• Applications using rdiscount gem with vulnerable Discount library versions
• Any software integrating affected Discount library versions for Markdown parsing

Discovery Timeline

• 2026-04-06 - CVE CVE-2026-35201 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35201

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read). The flaw exists in the default Markdown parsing path where input length handling fails to properly account for values exceeding the maximum signed integer boundary. When processing Markdown content, the library accepts input size as an unsigned value but internally truncates it to a signed integer type before passing it to the native parser functions.

The integer truncation occurs because the parser was designed with the assumption that input sizes would reasonably fit within INT_MAX (2,147,483,647 bytes). When an attacker supplies input larger than this threshold, the truncation causes the internal length variable to wrap around or become a small positive or negative value, while the actual buffer pointer still references the full oversized input.

This mismatch between the perceived buffer length and actual allocation allows the parser to read memory beyond the intended buffer boundaries during Markdown processing operations.

Root Cause

The root cause is a signed length truncation bug where input sizes larger than INT_MAX are improperly cast to a signed int data type. This integer truncation issue results from the library's internal assumption about maximum input sizes and the unsafe conversion from larger unsigned types to smaller signed types without proper bounds checking.

Attack Vector

The attack vector is network-based with high attack complexity. An attacker can exploit this vulnerability by sending specially crafted Markdown input exceeding INT_MAX bytes to an application using the vulnerable Discount library. The attack requires:

1. Identifying an application endpoint that processes user-supplied Markdown content
2. Crafting a Markdown payload larger than 2GB (INT_MAX bytes)
3. Sending the oversized payload to trigger the integer truncation
4. The parser then reads past the buffer boundary, causing a crash

The vulnerability manifests in the boundary handling logic during Markdown parsing. When the library attempts to process the malformed length value, it reads memory locations beyond the allocated buffer, leading to application crashes. For complete technical details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35201

Indicators of Compromise

• Unexpected application crashes in services processing Markdown content
• Abnormally large HTTP requests or file uploads containing Markdown data
• Segmentation fault errors in logs related to Markdown parsing operations
• Memory access violation exceptions in applications using Discount library

Detection Strategies

• Monitor for unusually large input payloads (>2GB) submitted to Markdown processing endpoints
• Implement logging and alerting for application crashes with stack traces pointing to Markdown parsing functions
• Deploy memory sanitizers (AddressSanitizer, Valgrind) in testing environments to detect out-of-bounds read attempts
• Use static analysis tools to identify applications using Discount library versions between 1.3.1.1 and 2.2.7.4

Monitoring Recommendations

• Configure application performance monitoring to track memory access patterns during Markdown processing
• Set up alerts for process crashes in services that handle user-supplied Markdown content
• Implement input size validation at the application layer to reject abnormally large Markdown submissions
• Review web application firewall logs for blocked requests with excessive payload sizes

How to Mitigate CVE-2026-35201

Immediate Actions Required

• Update Discount library to version 2.2.7.4 or later immediately
• Update rdiscount gem to the latest version that includes the patched Discount library
• Implement input size validation to reject Markdown inputs exceeding reasonable thresholds
• Consider temporarily disabling Markdown processing for untrusted input until patching is complete

Patch Information

The vulnerability has been fixed in Discount version 2.2.7.4. Organizations should upgrade to this version or later to remediate the vulnerability. The fix addresses the signed length truncation bug by implementing proper bounds checking before the integer conversion occurs, ensuring that inputs larger than INT_MAX are rejected or handled safely before reaching the vulnerable code path.

For detailed patch information and upgrade guidance, consult the GitHub Security Advisory.

Workarounds

• Implement input size validation at the application layer to reject Markdown content larger than a safe threshold (recommended: well below INT_MAX)
• Deploy web application firewall rules to block HTTP requests with excessively large payloads targeting Markdown processing endpoints
• Isolate Markdown processing in sandboxed environments to limit the impact of potential crashes
• Consider using alternative Markdown parsing libraries that are not affected by this vulnerability until patching is possible

# Configuration example - Input size validation for nginx
# Limit client body size to prevent oversized Markdown submissions
client_max_body_size 100M;

# Log large request attempts for monitoring
if ($content_length > 104857600) {
    access_log /var/log/nginx/large_requests.log;
}