discount - Debian Package Tracker

general

source: discount (main)
version: 2.2.7-2.1
maintainer: Alessandro Ghedini (DMD)
arch: any
std-ver: 4.6.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.2.6-1
oldstable: 2.2.7-2
stable: 2.2.7-2.1
testing: 2.2.7-2.1
unstable: 2.2.7-2.1

versioned links

2.2.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.2.7-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.2.7-2.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

discount (2 bugs: 0, 1, 1, 0)
libmarkdown2
libmarkdown2-dev

action needed

A new upstream version is available: 3.0.1.2 high

A new upstream version 3.0.1.2 is available, you should consider packaging it.

Created: 2025-11-26 Last update: 2026-04-11 16:01

2 security issues in trixie high

There are 2 open security issues in trixie.

1 important issue:

CVE-2026-4833: A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project maintainer confirms: "[I]f you feed it an infinitely deep blockquote input it will crash. (...) [T]his is a duplicate of an old bug that I've been working on."

1 issue left for the package maintainer to handle:

CVE-2026-35201: (needs triaging) Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process. This vulnerability is fixed in 2.2.7.4.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-03-27 Last update: 2026-04-11 02:00

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-4833: A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project maintainer confirms: "[I]f you feed it an infinitely deep blockquote input it will crash. (...) [T]his is a duplicate of an old bug that I've been working on."
CVE-2026-35201: Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process. This vulnerability is fixed in 2.2.7.4.

Created: 2026-03-27 Last update: 2026-04-11 02:00

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-4833: A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project maintainer confirms: "[I]f you feed it an infinitely deep blockquote input it will crash. (...) [T]his is a duplicate of an old bug that I've been working on."
CVE-2026-35201: Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process. This vulnerability is fixed in 2.2.7.4.

Created: 2026-03-27 Last update: 2026-04-11 02:00

2 security issues in bullseye high

There are 2 open security issues in bullseye.

1 important issue:

CVE-2026-4833: A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project maintainer confirms: "[I]f you feed it an infinitely deep blockquote input it will crash. (...) [T]his is a duplicate of an old bug that I've been working on."

1 issue postponed or untriaged:

CVE-2026-35201: (postponed; to be fixed through a stable update) Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process. This vulnerability is fixed in 2.2.7.4.

Created: 2026-03-27 Last update: 2026-04-11 02:00

2 security issues in bookworm high

There are 2 open security issues in bookworm.

1 important issue:

CVE-2026-4833: A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project maintainer confirms: "[I]f you feed it an infinitely deep blockquote input it will crash. (...) [T]his is a duplicate of an old bug that I've been working on."

1 issue left for the package maintainer to handle:

CVE-2026-35201: (needs triaging) Discount is an implementation of John Gruber's Markdown markup language in C. From 1.3.1.1 to before 2.2.7.4, a signed length truncation bug causes an out-of-bounds read in the default Markdown parse path. Inputs larger than INT_MAX are truncated to a signed int before entering the native parser, allowing the parser to read past the end of the supplied buffer and crash the process. This vulnerability is fixed in 2.2.7.4.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-03-27 Last update: 2026-04-11 02:00

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

Created: 2024-11-15 Last update: 2026-04-10 03:02

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-04-06 Last update: 2026-04-11 19:00

debian/patches: 1 patch to forward upstream low

Among the 4 debian patches available in version 2.2.7-2.1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2024-11-16 11:05

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.0).

Created: 2022-05-11 Last update: 2026-03-31 15:01

news

[rss feed]

[2024-11-21] discount 2.2.7-2.1 MIGRATED to testing (Debian testing watch)
[2024-11-15] Accepted discount 2.2.7-2.1 (source) into unstable (Marcos Talau)
[2021-09-09] discount 2.2.7-2 MIGRATED to testing (Debian testing watch)
[2021-09-03] Accepted discount 2.2.7-2 (source) into unstable (Alessandro Ghedini)
[2021-09-03] Accepted discount 2.2.7-1 (source) into unstable (Alessandro Ghedini)
[2019-07-18] discount 2.2.6-1 MIGRATED to testing (Debian testing watch)
[2019-07-12] Accepted discount 2.2.6-1 (source) into unstable (Alessandro Ghedini)
[2018-10-02] Accepted discount 2.2.2-1+deb9u1 (source amd64) into proposed-updates->stable-new, proposed-updates (Markus Koschany)
[2018-09-14] Accepted discount 2.2.2-1+deb9u1 (source amd64) into stable->embargoed, stable (Markus Koschany)
[2018-09-08] Accepted discount 2.1.7-1+deb8u1 (source amd64) into oldstable (Markus Koschany)
[2018-08-16] discount 2.2.4-1 MIGRATED to testing (Debian testing watch)
[2018-08-11] Accepted discount 2.2.4-1 (source) into unstable (Alessandro Ghedini)
[2017-10-23] discount 2.2.3b8-2 MIGRATED to testing (Debian testing watch)
[2017-10-17] Accepted discount 2.2.3b8-2 (source) into unstable (Alessandro Ghedini)
[2017-09-25] discount 2.2.3b8-1 MIGRATED to testing (Debian testing watch)
[2017-09-20] Accepted discount 2.2.3b8-1 (source) into unstable (Alessandro Ghedini)
[2017-01-30] discount 2.2.2-1 MIGRATED to testing (Debian testing watch)
[2017-01-19] Accepted discount 2.2.2-1 (source amd64) into unstable (Alessandro Ghedini)
[2016-11-25] discount 2.2.1-1 MIGRATED to testing (Debian testing watch)
[2016-11-19] Accepted discount 2.2.1-1 (source amd64) into unstable (Alessandro Ghedini)
[2016-08-09] discount 2.2.0+git20160802-1 MIGRATED to testing (Debian testing watch)
[2016-08-02] Accepted discount 2.2.0+git20160802-1 (source amd64) into unstable (Alessandro Ghedini)
[2016-04-23] Accepted discount 2.2.0-1 (source amd64) into unstable (Alessandro Ghedini)
[2015-04-27] discount 2.1.8-2 MIGRATED to testing (Britney)
[2015-04-10] Accepted discount 2.1.8-2 (source amd64) into unstable (Alessandro Ghedini)
[2015-01-31] Accepted discount 2.1.8-1 (source amd64) into unstable (Alessandro Ghedini)
[2013-10-30] discount 2.1.7-1 MIGRATED to testing (Debian testing watch)
[2013-10-19] Accepted discount 2.1.7-1 (source amd64) (Alessandro Ghedini)
[2013-05-09] discount 2.1.6-2 MIGRATED to testing (Debian testing watch)
[2013-04-28] Accepted discount 2.1.6-2 (source amd64) (Alessandro Ghedini)

bugs [bug history graph]

all: 5
RC: 0
I&N: 3
M&W: 2
F&P: 0
patch: 1

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.2.7-2.1build1
1 bug