CVE-2026-35201: rdiscount Out-of-bounds Read Vulnerability
Summary
CVE-2026-35201: rdiscount has an Out-of-bounds Read. Affects rdiscount versions >= 1.3.1.1, < 2.2.7.4. Fixed in 2.2.7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rdiscount is a Ruby library used for parsing Markdown into HTML. It is known for its speed and efficiency in converting Markdown text into formatted HTML. However, it has a vulnerability that can lead to an out-of-bounds read, potentially causing a denial-of-service condition when handling large inputs.
Vulnerability Detail
The vulnerability arises from a signed length truncation bug that allows inputs larger than INT_MAX to be processed incorrectly. When the length of the input exceeds INT_MAX, it is truncated to a negative signed integer, leading the parser to read beyond the allocated buffer. This can cause a segmentation fault and crash the Ruby process. The affected APIs include RDiscount.new(input).to_html and RDiscount.new(input).toc_content, making it critical for applications that parse user-controlled Markdown content.
How To Fix
Minimum fixed version
2.2.7.4
This is the first release that contains the fix.
gem install rdiscount -v 2.2.7.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the size of the input to the rdiscount parser by validating the input length before processing. For example: if (input.length > MAX_ALLOWED_LENGTH) { raise 'Input too large'; } This will prevent the parser from attempting to process excessively large inputs.
Conclusion
The rdiscount library has a significant vulnerability (CVE-2026-35201) that can lead to an out-of-bounds read and potential denial-of-service. It is crucial to update to the patched version or implement workarounds to ensure the security of applications using this library.
See every vulnerability recorded for rdiscount →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability.
The primary consequence is a denial-of-service condition, where the application may crash due to an out-of-bounds read, especially when processing large Markdown inputs.
Yes, a patched version of rdiscount is available. You should update to version 2.2.7.4 or later to mitigate this vulnerability.
If an immediate update is not possible, implement input validation to restrict the size of Markdown inputs to prevent triggering the vulnerability.
