CVE-2026-41680 Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer

🗓️ 24 Apr 2026 17:26:27Reported by GitHub_MType

Marked 18.0.0–18.0.1 permits DoS via infinite recursion on a 3-byte input, causing memory exhaustion; fixed in 18.0.2.

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	20 May 202613:41	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in marked-14.0.0.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-**-***)	4 May 202614:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub	23 Jun 202606:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Bob	26 May 202614:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses marked-14.0.0.tgz which is vulnerable to CVE-2026-41680	23 Jun 202613:34	–	ibm
ATTACKERKB	CVE-2026-41680	24 Apr 202617:26	–	attackerkb
Circl	CVE-2026-41680	23 Apr 202601:54	–	circl
CNNVD	marked 资源管理错误漏洞	24 Apr 202600:00	–	cnnvd
CVE	CVE-2026-41680	24 Apr 202617:26	–	cve

[
  {
    "vendor": "markedjs",
    "product": "marked",
    "versions": [
      {
        "version": ">= 18.0.0, < 18.0.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7

24 Apr 2026 17:26Current

CVSS 48.7

EPSS0.00342

marked vulnerability infinite recursion memory exhaustion three byte sequence denial of service