CVE-2026-77088

justhtml versions 0.9.0 through 1.21.0 are affected by a cross-site scripting (XSS) vulnerability in the to_markdown() function. The root cause is that inline code spans fail to treat blank lines as block boundaries. An attacker can inject blank lines into or element text to break the inline sp...

EUVD-2026-64657

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...

CVE-2026-77088 justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...

GHSA-JF6W-2MVX-633J justhtml: to_markdown() code-span blank-line breakout enables XSS

justhtml: tomarkdown code-span blank-line breakout enables XSS Summary In justhtml 0.9.0 through 1.21.0, tomarkdown renders text and text inside a link as an inline Markdown code span whose only protection is backtick-fence length. A blank line \n\n in that text terminates the inline span in any...

PT-2026-55844

justhtml: to markdown code-span blank-line breakout enables XSS Summary In justhtml 0.9.0 through 1.21.0, to markdown renders text and text inside a link as an inline Markdown code span whose only protection is backtick-fence length. A blank line in that text terminates the inline span in any...

rack: Rack memory exhaustion denial of service

A denial of service flaw has been found in the rubygems rack package. Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line CRLFCRLF. The parser keeps appending incoming bytes to memory without a size cap, allowing...

EUVD-2025-32850

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line CRLFCRLF. The parser keeps appending incoming bytes to memory witho...

fetchmail -- potential crash when authenticating to SMTP server

Matthias Andree reports: fetchmail's SMTP client, when configured to authenticate, is susceptible to a protocol violation where, when a trusted but malicious or malfunctioning SMTP server responds to an authentication request with a "334" code but without a following blank on the line, it will...