brinmon/cve-2024-44337
CVE-2024-44337 POC The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely.
The package "github.com/gomarkdown/markdown" is a Go library for parsing Markdown text and rendering it as HTML. In pseudo-version 'v0.0.0-20240729232818-a2a9c4f' corresponding to commit 'a2a9c4f76ef5a5c32108e36f7c47f8d310322252' and earlier, there is a logic issue in the paragraph function of the parser/block.go file. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) condition by providing specially crafted input that triggers an infinite loop, causing the program to hang and consume resources indefinitely. Commit 'a2a9c4f76ef5a5c32108e36f7c47f8d310322252' contains a patch for this issue.
The Chinese version of the reproduction and exploitation process is still under review at the Xianzhi Community, and the link will be placed here when it is ready.
