CVE-2021-41168

Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vulnerable to denial of service attacks to its reference table implementation. References written in markdown ` [reference_name]: https://www.example.com` are inserted into a hash table which was found to have a weak hash function, meaning that an attacker can reliably generate a large number of collisions for it. This makes the hash table vulnerable to a hash-collision DoS attack, a type of algorithmic complexity attack. Further the hash table allowed for duplicate entries resulting in long retrieval times. Proofs of concept and further discussion of the hash collision issue are discussed on the snudown GHSA(https://github.com/reddit/snudown/security/advisories/GHSA-6gvv-9q92-w5f6). Users are advised to update to version 1.7.0.

• CWE-20
• CWE-327
• CWE-400
• CWE-407

• https://github.com/reddit/snudown/commit/1ac2c130b210539ee1e5d67a7bac93f9d8007c0ePatch, Third Party Advisory
• https://github.com/reddit/snudown/security/advisories/GHSA-6gvv-9q92-w5f6Exploit, Third Party Advisory
• https://github.com/reddit/snudown/commit/1ac2c130b210539ee1e5d67a7bac93f9d8007c0ePatch, Third Party Advisory
• https://github.com/reddit/snudown/security/advisories/GHSA-6gvv-9q92-w5f6Exploit, Third Party Advisory

Published

Oct 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41162Combodo iTop is a web based IT Service Management tool. In 3…6.1
• CVE-2021-41163Discourse is an open source platform for community discussio…9.8
• CVE-2021-41164CKEditor4 is an open source WYSIWYG HTML editor. In affected…5.4
• CVE-2021-41165CKEditor4 is an open source WYSIWYG HTML editor. In affected…5.4
• CVE-2021-41166The Nextcloud Android app is the Android client for Nextclou…5.3
• CVE-2021-41167modern-async is an open source JavaScript tooling library fo…7.5
• CVE-2021-41169Sulu is an open-source PHP content management system based o…4.8
• CVE-2021-4117yetiforcecrm is vulnerable to Business Logic Errors4.3
• CVE-2021-41170neoan3-apps/template is a neoan3 minimal template engine. Ve…9.8
• CVE-2021-41171eLabFTW is an open source electronic lab notebook manager fo…8.8
• CVE-2021-41172AS_Redis is an AntSword plugin for Redis. The Redis Manage p…5.4
• CVE-2021-41173Go Ethereum is the official Golang implementation of the Eth…5.7