rdiscount-2.2.7.3.gem: 1 vulnerabilities (highest severity is: 5.9)

[mend-bolt-for-github]

Vulnerable Library - rdiscount-2.2.7.3.gem

Library home page: https://rubygems.org/gems/rdiscount-2.2.7.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /Gemfile.lock

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (rdiscount version)	Remediation Possible**
CVE-2026-35201	Medium	5.9	rdiscount-2.2.7.3.gem	Direct	https://github.com/davidfstr/rdiscount.git - 2.2.7.4	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-35201

Vulnerable Library - rdiscount-2.2.7.3.gem

Library home page: https://rubygems.org/gems/rdiscount-2.2.7.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /Gemfile.lock

Dependency Hierarchy:

• ❌ rdiscount-2.2.7.3.gem (Vulnerable Library)

Found in base branch: source

Vulnerability Details

Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process. This vulnerability is fixed in 2.2.7.4.

Publish Date: 2026-04-06

URL: CVE-2026-35201

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6r34-94wq-jhrc

Release Date: 2026-04-06

Fix Resolution: https://github.com/davidfstr/rdiscount.git - 2.2.7.4

Step up your Open Source Security Game with Mend here