DEBIAN-CVE-2026-4833
A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project maintainer confirms: "[I]f you feed it an infinitely deep blockquote input it will crash. (...) [T]his is a duplicate of an old bug that I've been working on."
DEBIAN-CVE-2026-4833
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-4833
discount
Source reference: /affected/0/package/name
- Affected versions
- 2.2.7-2
Source reference:
/affected/0/versions2.2.7-2.1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
discount
Source reference: /affected/1/package/name
- Affected versions
- 2.2.7-2.1
Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
discount
Source reference: /affected/2/package/name
- Affected versions
- 2.2.7-2.1
Source reference:
/affected/2/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "discount",
"purl": "pkg:deb/debian/discount?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.2.7-2",
"2.2.7-2.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4833.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "discount",
"purl": "pkg:deb/debian/discount?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2.2.7-2.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4833.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "discount",
"purl": "pkg:deb/debian/discount?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"2.2.7-2.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4833.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57168 · Revision 1
- Added to Heist Feed
- Publisher date