rdiscount

Version	Released
`2.2.7.5` patch	Apr 27, 2026
`2.2.7.4` patch	Apr 02, 2026
`2.2.7.3` patch 1 CVE	Dec 31, 2023
`2.2.7.2` patch 1 CVE	Dec 19, 2023
`2.2.7.1` patch 1 CVE	Jun 16, 2023
`2.2.7` patch 1 CVE	Oct 24, 2022
`2.2.0.2` patch 1 CVE	Aug 09, 2020
`2.2.0.1` patch 1 CVE	May 07, 2016
`2.2.0` minor 1 CVE	Feb 01, 2015
`2.1.8` patch 1 CVE	Feb 01, 2015
`2.1.7.1` patch 1 CVE	Apr 12, 2014
`2.1.7` patch 1 CVE	Oct 13, 2013
`2.1.6` minor 1 CVE	May 28, 2013
`2.0.7.3` patch 1 CVE	May 07, 2013
`2.0.7.2` patch 1 CVE	Apr 06, 2013
`2.0.7.1` patch 1 CVE	Feb 26, 2013
`2.0.7` major 1 CVE	Jan 29, 2013
`1.6.8` patch 1 CVE	Jan 25, 2011
`1.6.5` patch 1 CVE	Jun 15, 2010
`1.6.3.2` patch 1 CVE	May 14, 2010
`1.6.3.1` patch 1 CVE	Apr 20, 2010
`1.6.3` minor 1 CVE	Mar 08, 2010
`1.5.8.1` patch 1 CVE	Mar 08, 2010
`1.5.8` patch 1 CVE	Feb 03, 2010
`1.5.5` minor 1 CVE	Nov 13, 2009
`1.3.5` patch 1 CVE	Jul 26, 2009
`1.3.4` patch 1 CVE	Mar 04, 2009
`1.3.1.1` patch 1 CVE	Jan 31, 2009
`1.3.1` minor	Jan 10, 2009
`1.2.11` patch	Nov 02, 2008
`1.2.10` patch	Sep 30, 2008
`1.2.9` patch	Aug 26, 2008
`1.2.7.1` patch	Aug 09, 2008
`1.2.7` patch	Aug 02, 2008
`1.2.6.2` initial	Jun 03, 2008

2.2.7.5 patch

Apr 27, 2026

2.2.7.4 patch

Apr 02, 2026

2.2.7.3 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Dec 31, 2023

2.2.7.2 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Dec 19, 2023

2.2.7.1 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Jun 16, 2023

2.2.7 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Oct 24, 2022

2.2.0.2 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Aug 09, 2020

2.2.0.1 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

May 07, 2016

2.2.0 minor

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Feb 01, 2015

2.1.8 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Feb 01, 2015

2.1.7.1 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Apr 12, 2014

2.1.7 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Oct 13, 2013

2.1.6 minor

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

May 28, 2013

2.0.7.3 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

May 07, 2013

2.0.7.2 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Apr 06, 2013

2.0.7.1 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Feb 26, 2013

2.0.7 major

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Jan 29, 2013

1.6.8 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Jan 25, 2011

1.6.5 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Jun 15, 2010

1.6.3.2 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

May 14, 2010

1.6.3.1 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Apr 20, 2010

1.6.3 minor

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Mar 08, 2010

1.5.8.1 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Mar 08, 2010

1.5.8 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Feb 03, 2010

1.5.5 minor

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Nov 13, 2009

1.3.5 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Jul 26, 2009

1.3.4 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Mar 04, 2009

1.3.1.1 patch

1 CVE

CVE-2026-35201 GHSA-6r34-94wq-jhrc Apr 06, 2026

rdiscount has an Out-of-bounds Read

5.9 / 10

Medium

Network High None None Unchanged None None High

Summary

A signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process

Details

In both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136

RSTRING_LEN(text) is passed directly into mkd_string():

MMIOT *doc = mkd_string(RSTRING_PTR(text), RSTRING_LEN(text), flags);

mkd_string() accepts int len:

ext/mkdio.c:174

Document * mkd_string(const char *buf, int len, mkd_flag_t flags)
{
    struct string_stream about;

    about.data = buf;
    about.size = len;

    return populate((getc_func)__mkd_io_strget, &about, flags & INPUT_MASK);
}

The parser stores the remaining input length in a signed int:

ext/markdown.h:205

struct string_stream {
    const char *data;
    int   size;
};

The read loop stops only when size == 0:

ext/mkdio.c:161

int __mkd_io_strget(struct string_stream *in)
{
    if ( !in->size ) return EOF;

    --(in->size);

    return *(in->data)++;
}

If the Ruby string length exceeds INT_MAX, the value can truncate to a negative int. In that state, the parser continues incrementing data and reading past the end of the original Ruby string, causing an out-of-bounds read and native crash.

Affected APIs:

RDiscount.new(input).to_html
RDiscount.new(input).toc_content

PoC

Crash via to_html:

RUBYLIB=lib:ext ruby -e 'require "rdiscount"; n=2_200_000_000; s = "a" * n; warn "built=#{s.bytesize}"; RDiscount.new(s).to_html"'

result:

built=2200000000
Ruby terminates with [BUG] Segmentation fault
top control frame: CFUNC :to_html

same result with toc_content

Impact

This is an out-of-bounds read with the main issue being reliable denial-of-service. Impacted is limited to deployments parses attacker-controlled Markdown and permits multi-GB inputs.

Fix

just add a checked length guard before the mkd_string() call in both public entry points:

ext/rdiscount.c:97
ext/rdiscount.c:136 ex:

VALUE text = rb_funcall(self, rb_intern("text"), 0);
long text_len = RSTRING_LEN(text);
VALUE buf = rb_str_buf_new(1024);
Check_Type(text, T_STRING);

if (text_len > INT_MAX) {
    rb_raise(rb_eArgError, "markdown input too large");
}

MMIOT *doc = mkd_string(RSTRING_PTR(text), (int)text_len, flags);

The same guard should be applied in rb_rdiscount_toc_content() before its mkd_string() call.

Affected versions


          1.3.1.1


          1.3.4


          1.3.5


          1.5.5


          1.5.8


          1.5.8.1


          1.6.3


          1.6.3.1


          1.6.3.2


          1.6.5


          1.6.8


          2.0.7

+ 14 more


            2.0.7.1


            2.0.7.2


            2.0.7.3


            2.1.6


            2.1.7


            2.1.7.1


            2.1.8


            2.2.0


            2.2.0.1


            2.2.0.2


            2.2.7


            2.2.7.1


            2.2.7.2


            2.2.7.3

Fixed in


          2.2.7.4

References

Updated May 13, 2026 · Source: OSV.dev

Jan 31, 2009

1.3.1 minor

Jan 10, 2009

1.2.11 patch

Nov 02, 2008

1.2.10 patch

Sep 30, 2008

1.2.9 patch

Aug 26, 2008

1.2.7.1 patch

Aug 09, 2008

1.2.7 patch

Aug 02, 2008

1.2.6.2 initial

Jun 03, 2008

Activity

Reach

Details