CVE-2026-4833: Orc Discount DOS Vulnerability

CVE-2026-4833 Overview

A Denial of Service vulnerability has been identified in Orc discount up to version 3.0.1.2. This issue affects the compile function in the file markdown.c of the Markdown Handler component. The vulnerability allows an attacker to trigger uncontrolled recursion by providing specially crafted input, leading to application crashes.

Critical Impact

An attacker with local access can cause a denial of service condition by providing deeply nested markdown content (such as infinitely deep blockquote input), causing the application to crash through stack exhaustion.

Affected Products

• Orc discount up to version 3.0.1.2
• Applications utilizing the Orc discount Markdown Handler component
• Systems processing untrusted markdown content through the affected library

Discovery Timeline

• March 26, 2026 - CVE-2026-4833 published to NVD
• March 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4833

Vulnerability Analysis

The vulnerability exists within the compile function of markdown.c in the Orc discount Markdown parsing library. When processing markdown content, the function recursively handles nested elements such as blockquotes without implementing proper depth limits or recursion guards. This creates a condition where an attacker can supply specially crafted markdown input with deeply nested structures that trigger unbounded recursion.

The project maintainer has confirmed this issue, stating: "If you feed it an infinitely deep blockquote input it will crash. This is a duplicate of an old bug that I've been working on." This acknowledgment indicates the issue has been known but remains unpatched in versions up to 3.0.1.2.

The attack requires local execution context, meaning an attacker needs the ability to supply input to an application using this library. While this limits the attack surface, applications that process user-supplied markdown content remain vulnerable to denial of service attacks.

Root Cause

The root cause is classified as CWE-404 (Improper Resource Shutdown or Release), though the vulnerability specifically manifests as uncontrolled recursion. The compile function in markdown.c lacks proper bounds checking on recursion depth when processing nested markdown elements like blockquotes. Without a maximum depth limit, the function continues to call itself for each level of nesting until stack space is exhausted, resulting in a crash.

Attack Vector

The attack vector is local, requiring an attacker to provide malicious input to an application that uses the Orc discount library for markdown processing. The attack can be executed by:

1. Creating a markdown file with deeply nested blockquote structures
2. Submitting the malicious content to any application that parses it using the vulnerable library
3. The recursive parsing without depth limits causes stack exhaustion and application crash

For technical details on the vulnerability and proof-of-concept, refer to GitHub Issue #305 and the associated crash report attachment.

Detection Methods for CVE-2026-4833

Indicators of Compromise

• Application crashes with stack overflow errors when processing markdown files
• Unusually deep nesting patterns in markdown input files, particularly blockquote characters (>)
• Segmentation faults or process termination in applications utilizing the Orc discount library
• Abnormal memory usage patterns before crash events

Detection Strategies

• Monitor for application crashes in processes using the Orc discount library (libmarkdown)
• Implement input validation to detect markdown files with excessive nesting depth before processing
• Deploy application crash monitoring to detect repeated denial of service attempts
• Review application logs for parsing errors related to markdown processing

Monitoring Recommendations

• Enable crash dump collection for applications using the Orc discount library to identify exploitation attempts
• Monitor system resource utilization (stack memory) for processes handling markdown content
• Implement file integrity monitoring on markdown input directories
• Configure alerting for repeated application restarts that may indicate DoS attacks

How to Mitigate CVE-2026-4833

Immediate Actions Required

• Identify all applications in your environment that use the Orc discount library for markdown processing
• Implement input validation to limit maximum nesting depth in markdown content before passing to the library
• Consider implementing resource limits (ulimit on Linux) to prevent uncontrolled stack consumption
• Isolate markdown processing in sandboxed environments where possible

Patch Information

At the time of publication, no official patch is available. The project maintainer has acknowledged this as a duplicate of a known bug that is being worked on. Monitor the Orc discount GitHub repository for updates and patch releases.

Organizations should subscribe to the project's release notifications and review GitHub Issue #305 for the latest remediation status and maintainer comments.

Workarounds

• Implement a pre-processing filter to detect and reject markdown input with excessive nesting depth
• Add wrapper functions around the library to enforce recursion limits before calling compile
• Use alternative markdown parsing libraries for processing untrusted content until a patch is available
• Deploy application sandboxing to limit the impact of crashes caused by this vulnerability

# Configuration example - limit stack size to prevent uncontrolled resource consumption
# Add to application startup script or system limits configuration
ulimit -s 8192  # Limit stack size to 8MB to prevent runaway recursion