Uncontrolled Recursion in marked - CVE-2026-41680

Vulnerability identifier: #VU126877

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-41680

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite recursion in the block tokenizer. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

marked
IBM Maximo Scheduler Optimization
Data Product Hub
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Decision Optimization for Cloud Pak for Data

Install updates from vendor's website.

marked - update to 18.0.2
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.22-sc2, 4.3.5
IBM Maximo Scheduler Optimization - addressed in versions 9.0.24, 9.1.13
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6
Data Product Hub - addressed in versions 5.3.1 Patch 7, 5.4.0

• Exploit #12619 - OOM Denial of Service via Infinite Recursion in marked@18.0.0 Tokenizer (April 23, 2026)

• https://github.com/markedjs/marked/security/advisories/GHSA-6v9c-7cg6-27q7

• Denial of service in marked
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Data Product Hub
• IBM Maximo Scheduler Optimization update for Marked
• IBM Automation Assets in IBM Cloud Pak for Integration (CP4I) update for Marked