CVE-2025-61732 — Potential code smuggling via doc comments in cmd/cgo

Affected: Go toolchain cmd/cgo, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions and 23 more

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

GHSA-77fj-vx54-gvh7 — Go Markdown has an Out-of-bounds Read in SmartypantsRenderer

Affected: Go: github.com/gomarkdown/markdown

### Summary

Processing a malformed input containing a `<` character that is not followed by a `>` character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic.

### Details

The `smartLeftAngle()` function in `html/smartypants.go:367-376` performs an out-of-bounds slice operation when processing a `<` character that is not followed by a `>` character anywhere in the remaining text. https://github.com/gomarkdown/markdown/blob/37c66b85d6ab025ba67a73ba03b7f3ef55859cca/html/smartypants.go#L367-L376 If the length of the slice is lower than its capacity, this leads to an extra byte of data read. If the length equals the capacity, this leads to a panic.

### PoC ```golang package main

import ( "bytes" "fmt"

"github.com/gomarkdown/markdown/html" )

func main() { src := []byte("<a")

fmt.Printf("Input: %q (len=%d, cap=%d)\n", src, len(src), cap(src))

var buf bytes.Buffer sp := html.NewSmartypantsRenderer(html.Smartypants) sp.Process(&buf, src) // panics: slice bounds out of range

fmt.Printf("Output: %q\n", buf.String()) } ```

### Impact This vulnerability will lead to a Denial of Service / panic on the processing service.

-- The Datadog Security Team

Most recent entries from all

CVE-2025-61732 — Potential code smuggling via doc comments in cmd/cgo

GHSA-77fj-vx54-gvh7 — Go Markdown has an Out-of-bounds Read in SmartypantsRenderer