5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35201

CVE-2026-35201: Discount has an Out-of-bounds Read in rdiscount

Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process. This vulnerability is fixed in 2.2.7.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35201

CVE-2026-35201:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rdiscount	rubygems	>= 1.3.1.1, < 2.2.7.4	2.2.7.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in an integer truncation issue within the rdiscount Ruby gem, leading to an out-of-bounds read and a denial-of-service. The core of the problem is in the C-extension code. The Ruby methods RDiscount.to_html and RDiscount.toc_content, implemented by the C functions rb_rdiscount_to_html and rb_rdiscount_toc_content respectively, would take a user-supplied string. The length of this string, represented as a long integer, was passed to the internal mkd_string function. However, mkd_string accepts the length as a standard int. When an input string with a length greater than INT_MAX (2,147,483,647 bytes) was processed, the long value was truncated to a negative int. This negative value was then used in the parsing logic, specifically in __mkd_io_strget, causing it to read memory far beyond the intended buffer, which reliably crashed the process. The patch addresses this by adding a validation function, rb_rdiscount__text_len, which checks if the input length exceeds INT_MAX and raises an exception if it does, preventing the unsafe call to mkd_string.

Vulnerable functions

RDiscount.to_html

ext/rdiscount.c

The `to_html` function (implemented as `rb_rdiscount_to_html` in C) was vulnerable to an out-of-bounds read. It passed the length of the input string, a `long`, directly to the `mkd_string` function, which expects an `int`. If the input string's length exceeded `INT_MAX`, the value would truncate to a negative number, causing the parser to read beyond the allocated buffer and crash the process.

RDiscount.toc_content

ext/rdiscount.c

The `toc_content` function (implemented as `rb_rdiscount_toc_content` in C) was vulnerable to the same out-of-bounds read as `to_html`. It passed the length of the input string, a `long`, directly to the `mkd_string` function, which expects an `int`. For input strings longer than `INT_MAX`, this caused an integer truncation, leading to a negative length and a subsequent buffer over-read, resulting in a denial-of-service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.