{"id":"EUVD-2026-25585","enisaUuid":"35fe83f0-718c-35f9-b0ab-0cda33acbbea","description":"Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\\x09\\x0b\\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.","datePublished":"Apr 24, 2026, 5:26:27 PM","dateUpdated":"Apr 24, 2026, 7:08:41 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7\n","aliases":"CVE-2026-41680\n","assigner":"GitHub_M","epss":0.34,"enisaIdProduct":[{"id":"b61d6ca7-ada2-3b6c-95ae-afb0e7a5f79e","product":{"name":"marked","vendor":{"name":"markedjs"}},"product_version":"18.0.0, \u003c 18.0.2"}],"enisaIdVendor":[{"id":"7631f75a-a47d-34e8-8ad3-c8fb249eba02","vendor":{"name":"markedjs"}}],"enisaIdVulnerability":[{"id":"7bde10a6-1e3f-3bd0-97cc-f9a9b71f1da4","vulnerability":{"id":"CVE-2026-41680","description":"Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\\x09\\x0b\\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.","datePublished":"Apr 24, 2026, 5:26:27 PM","dateUpdated":"Apr 24, 2026, 7:08:41 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7\n","enisa_id":"EUVD-2026-25585\n","assigner":"GitHub_M","epss":0.34,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"92801cd4-a143-3813-b00b-22a30d7ea6cc","product":{"name":"marked","vendor":{"name":"markedjs"}},"product_version":"18.0.0, \u003c 18.0.2"}],"vulnerabilityVendor":[{"id":"1695a575-0c4e-3aff-b5ff-1aaf77c39012","vendor":{"name":"markedjs"}}]}},{"id":"b88cafc1-af22-3373-ac82-4f3c1df9eec4","vulnerability":{"id":"GHSA-6v9c-7cg6-27q7","description":"Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer","datePublished":"Apr 29, 2026, 10:12:20 PM","dateUpdated":"Apr 29, 2026, 10:12:20 PM","baseScore":0.0,"references":"https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41680\nhttps://github.com/markedjs/marked\n","enisa_id":"EUVD-2026-25585\n","aliases":"GHSA-6v9c-7cg6-27q7\nCVE-2026-41680\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"5532d794-cf83-3877-828b-142d57cb78a5","advisory":{"id":"RHSA-2026:26225","description":"Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image","summary":"A new satellite/iop-vulnerability-frontend-rhel9 container image is now available as a technical preview in the Red Hat container registry.","datePublished":"Jun 16, 2026, 9:06:09 AM","dateUpdated":"Oct 21, 2026, 9:01:06 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:26225\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26225.json\n","aliases":"CVE-2026-6322\nCVE-2026-9277\nCVE-2026-26996\nCVE-2026-27904\nCVE-2026-29063\nCVE-2026-41680\nCVE-2026-42033\nCVE-2026-42035\nCVE-2026-42039\nCVE-2026-42041\nCVE-2026-42043\nCVE-2026-42044\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"ccba8b50-c790-3d9a-9db8-f7b4ffc6ff73","product":{"name":"Red Hat Satellite 6.18","vendor":{"name":"Red Hat"}}},{"id":"d1c4f5cf-dede-343c-bc80-181b570bd3d3","product":{"name":"registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9@sha256:6af0a58a2e872d0e59c61277af795867da59174f53969162e162e9acb4ca9c35_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"81060b62-bd77-3f89-8827-45cd4df5ec9c","advisory":{"id":"RHSA-2026:79243","description":"Red Hat Security Advisory: Red Hat Ceph Storage","summary":"A new version of Red Hat build of Ceph Storage has been released","datePublished":"Oct 8, 2026, 1:55:19 PM","dateUpdated":"Oct 23, 2026, 4:49:45 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:79243\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79243.json\n","aliases":"CVE-2021-43565\nCVE-2022-27191\nCVE-2023-48795\nCVE-2024-48916\nCVE-2025-30156\nCVE-2026-21721\nCVE-2026-39944\nCVE-2026-41680\nCVE-2026-50152\nCVE-2026-54330\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"10113f61-4bee-317c-a6b1-b3bae864cc62","product":{"name":"registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:c7b2e91a1aea2c255e8b9315f2f6fecbe7a708d6a2b2ea0b8cef5e20267b5ab2_amd64","vendor":{"name":"Red Hat"}}},{"id":"186a1391-a6a7-3e2b-bb45-1c13bdc1d562","product":{"name":"registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:8c4bfcd647337733f6a1c05957d7b8bb8dff61a0ac33d7cc3a4b22717030354f_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"1bca3b15-8611-3b61-ae56-bdadcad7a796","product":{"name":"registry.redhat.io/rhceph/grafana-rhel9@sha256:c19e1ec7ad2e588d51e5934fb97c64965e948479aed4751939e8398cd0f008f1_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"1e508a5d-1848-3290-a87e-53da460cde50","product":{"name":"registry.redhat.io/rhceph/grafana-rhel9@sha256:80a251fa12bc350ca8aab1dd9054f86768119b20fc38b484c17af50805d19b98_arm64","vendor":{"name":"Red Hat"}}},{"id":"2681b0fe-075f-38cf-a886-9c84041a6a86","product":{"name":"registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:7f2e0116d878ba773de63badc8bc9f178855a095002bed80cc536aff319617a3_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"2bd7d405-aef9-3dea-9ef9-3b0fe9927f33","product":{"name":"registry.redhat.io/rhceph/oauth2-proxy-rhel9@sha256:332cf62937c53b1495812dcb3fd8d39df372572c6cf3b6fe7e8ea9aa0a05dd5b_amd64","vendor":{"name":"Red Hat"}}},{"id":"34c6f2a3-1a6f-3f68-a223-ed852b5ac598","product":{"name":"registry.redhat.io/rhceph/grafana-rhel9@sha256:606c3c9fb7e17de1b3e5981c0e8fe060fd4db6a94c04840008ef79bcf50386b0_amd64","vendor":{"name":"Red Hat"}}},{"id":"3cc5062f-232d-3171-81d0-54dc094afd02","product":{"name":"registry.redhat.io/rhceph/keepalived-rhel9@sha256:17050d0ebc49274ce706e4639ca6502f3750127893bc534314a86958e581553a_amd64","vendor":{"name":"Red Hat"}}},{"id":"5909f707-609a-36bf-8825-ae03bfc9d694","product":{"name":"registry.redhat.io/rhceph/oauth2-proxy-rhel9@sha256:71361c1aba8442e9e21af026d3a73c2f5124ef472766545f55f77dfe7d033bbe_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"602cb6a4-f749-3d7f-b88c-2028ed7250dc","product":{"name":"registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:5496d6b783ed5b48d6ba889d7e656d8fb9c47fc87149fce88cb1ce5e18970f20_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"615d79d9-9ea7-306c-ad94-ed8053ea8fd9","product":{"name":"registry.redhat.io/rhceph/oauth2-proxy-rhel9@sha256:d20e25c02cad018ced68410396b1385c6ee201fbfe61590f3a80ed0ad9c660b3_s390x","vendor":{"name":"Red Hat"}}},{"id":"6c424000-6c78-3f1c-8d59-5ef7eb71506e","product":{"name":"registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:7a5133f2adbd7d8d7953484c53eec5914d9fa055c7327b474e843fa2e083a7ed_arm64","vendor":{"name":"Red Hat"}}},{"id":"6d2f7adf-0013-3818-a9b2-adf2084251f8","product":{"name":"registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:2b2d9fc84f4cc9827ca03406a1ee778f11c8f996cec379c12465dfae21bf5832_s390x","vendor":{"name":"Red Hat"}}},{"id":"7af9a050-16ce-3df3-a058-537ac7c7e174","product":{"name":"registry.redhat.io/rhceph/keepalived-rhel9@sha256:22d113b46e255d4683a4ae929ede3e14e1c75495895abeb9636a9f8f6f8cc2eb_s390x","vendor":{"name":"Red Hat"}}},{"id":"7f085b4c-3830-30c0-86fe-170cb751200f","product":{"name":"registry.redhat.io/rhceph/keepalived-rhel9@sha256:4ee6f59422288387c4acff7da0f8cb4c12bfe94690da4986f1358c13b0295008_arm64","vendor":{"name":"Red Hat"}}},{"id":"807641a1-77d7-323e-bff8-cbc28a2bb0c6","product":{"name":"registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:fa0c153625d122b206fab5d14adb467dacf192212e147772ad5d6efee016adac_amd64","vendor":{"name":"Red Hat"}}},{"id":"847c5fb3-e9d8-343a-b598-435e17f66d7a","product":{"name":"registry.redhat.io/rhceph/grafana-rhel9@sha256:25c748548e1514f7ddde641f081497cd94a71518de62a141cf0c7fef6fa5a00c_s390x","vendor":{"name":"Red Hat"}}},{"id":"925ad9e5-e2bb-3183-969a-05b7dda9ef1a","product":{"name":"registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:05abd08e664508106bb57a18b75147007276a9368676a919a61080930c478c51_arm64","vendor":{"name":"Red Hat"}}},{"id":"9b9c3e61-1efa-3626-a7be-4878209e82a3","product":{"name":"registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:10f7a403879682ffa0e674ebf5bd537bd36da428d981712ada80f20c71257822_s390x","vendor":{"name":"Red Hat"}}},{"id":"9d49f6ff-8041-346f-bc4b-1a046862542c","product":{"name":"registry.redhat.io/rhceph/oauth2-proxy-rhel9@sha256:54b27c84bb316bae524d131fbf51ca7fc38784e9f3384137b660e961a71dc340_arm64","vendor":{"name":"Red Hat"}}},{"id":"a6788a77-c3cf-3b3f-b1aa-2248895c8eab","product":{"name":"registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:52f5863ea71c31cf51b9f75f57ef362b99217d75be9896fcb453a2d1e2755f54_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"a6b1951c-59ec-3f0a-819f-77958edea623","product":{"name":"registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:d804229ee55b5eb1a99a95a71bad2de5a1675783da6fd661d85ede1eca1ced70_arm64","vendor":{"name":"Red Hat"}}},{"id":"a9a60c8f-8ba2-3aa7-9421-48656ce17ad5","product":{"name":"registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:e4bf3c69d6a14eb59d794dcbb94d8cc64940ddb798595c2d1f1d2b86d0cf5240_amd64","vendor":{"name":"Red Hat"}}},{"id":"b01b2782-c6f6-33e5-aff4-bce48f23bc3a","product":{"name":"Red Hat Ceph Storage 8.1","vendor":{"name":"Red Hat"}}},{"id":"c0af8ca7-41e7-35a4-b221-9c526e34d2d3","product":{"name":"registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:95c1012aebbf1d2f11cb64830378a86459e47111dfd3b3d3f0747c463fcec6b3_amd64","vendor":{"name":"Red Hat"}}},{"id":"f0023832-2a51-3f40-b795-52f3fa1e6d00","product":{"name":"registry.redhat.io/rhceph/keepalived-rhel9@sha256:2a0ef10019c0d9fc2ba03b3ffbffe48d352f62d4124155dae4d166498b3eb1c7_ppc64le","vendor":{"name":"Red Hat"}}},{"id":"f11a0814-ff43-3002-a54b-edde4f680604","product":{"name":"registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:47877aea3d5142a42b01dbe8108ead76b55c92fac60433816dce699bfde9ec27_s390x","vendor":{"name":"Red Hat"}}},{"id":"f6ecd524-8278-3b66-b271-6d85d275d8fa","product":{"name":"registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:cc52ebdd7b4d1252b71a8fbeb94e2cd6f842054c1edceebfe51efef48a62ea54_s390x","vendor":{"name":"Red Hat"}}},{"id":"fdec2ce7-b7c4-3b1b-973c-f4f887e34bbd","product":{"name":"registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:32887d89e509c051aafe9918a09b410b50d568396d7bb55978cdab3b78d34156_arm64","vendor":{"name":"Red Hat"}}}]}},{"id":"f5c3bea7-a257-3320-b4a3-2f550fb523df","advisory":{"id":"RHSA-2026:26214","description":"Red Hat Security Advisory: General availability of the satellite/iop-advisor-frontend-rhel9 container image","summary":"A new satellite/iop-advisor-frontend-rhel9 container image is now generally available in the Red Hat container registry.","datePublished":"Jun 16, 2026, 8:52:55 AM","dateUpdated":"Oct 21, 2026, 9:01:11 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:26214\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26214.json\n","aliases":"CVE-2025-69873\nCVE-2026-6321\nCVE-2026-26996\nCVE-2026-27904\nCVE-2026-41680\nCVE-2026-42033\nCVE-2026-42035\nCVE-2026-42039\nCVE-2026-42041\nCVE-2026-42043\nCVE-2026-42044\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"73267ad1-fd55-330c-bd66-12250c51ad20","product":{"name":"registry.redhat.io/satellite/iop-advisor-frontend-rhel9@sha256:2fa7abb9dbae17fc3b6c7b6a5edbbff617e9a1a86256a61f714a1b8dbaf14105_amd64","vendor":{"name":"Red Hat"}}},{"id":"ad89e89f-6108-36fe-b14a-dd8b698a96a2","product":{"name":"Red Hat Satellite 6.18","vendor":{"name":"Red Hat"}}}]}}]}