Infinite Loop DoS in gomarkdown/markdown Parser

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-44337, a denial-of-service (DoS) vulnerability in the Go library github.com/gomarkdown/markdown. The vulnerability exists in versions prior to commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, specifically in the paragraph function of parser/block.go. The exploit consists of a Go program (exp/fuzz.go) that feeds a specially crafted string to the markdown parser, causing it to enter an infinite loop and hang, thus consuming resources indefinitely. The repository also includes crash output files demonstrating the hang and stack trace, as well as documentation in both English and Chinese. The main attack vector is remote: an attacker can supply malicious Markdown input to any application using the vulnerable library, potentially over a network (e.g., via a web form or API). No hardcoded network endpoints are present, but the exploit targets the file path of the vulnerable function within the library.