Executive brief
RDiscount is a Ruby library used to convert Markdown text into HTML. A flaw in how the library handles extremely large text inputs (over 2GB) can cause the application to crash. This could be used by an attacker to perform a denial-of-service attack, making the affected website or service unavailable to users.
Technical details
A signed length truncation vulnerability exists in the RDiscount Ruby gem's interface with the Discount C library. When a Ruby string exceeds INT_MAX (approximately 2GB), the length is truncated to a negative integer when passed to the `mkd_string()` function. Because the internal parser loop in `__mkd_io_strget` only terminates when the remaining size reaches zero, a negative starting size causes the parser to read past the end of the allocated buffer. This results in an out-of-bounds read and a segmentation fault (denial of service). The vulnerability affects the `to_html` and `toc_content` APIs and is fixed in version 2.2.7.4 by adding a length check before calling the native parser.
Affected products
- davidfstr rdiscount >= 1.3.1.1, < 2.2.7.4
Timeline
- 2026-04-04: advisory: GitHub Security Advisory published by maintainer
- 2026-04-06: disclosed: CVE-2026-35201 published
- 2026-04-06: patched: Fixed in version 2.2.7.4