CVE-2026-102941

## Summary IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022). ## The defect parser/parser.go, IsSafeURL: ```go func IsSafeURL(url []byte) bool { nLink := len(url) for _, path := range validPaths { // "/", "./", "../" nPath := len(path) linkPrefix := url[:nPath] // line 789: sliced BEFORE the length guard if nLink >= nPath && bytes.Equal(linkPrefix, path) { // line 790: guard is too late ... ``` url[:nPath] is evaluated before the `nLink >= nPath` check. When len(url) < nPath and cap(url) < nPath, the slice expression panics. Only the relative-path loop is affected; the adjacent URIs loop is already correctly guarded (the signal that this one deviates, the same signal as the anchor). Input: IsSafeURL("") panics ([:1] cap 0), IsSafeURL(".") panics ([:2] cap 1), IsSafeURL("..") panics ([:3] cap 2), while IsSafeURL("/") returns true. End to end: `markdown.ToHTML(input, html.CommonFlags|html.Safelink)` with input `[x]()` panics. Attacker model: (1) any service rendering untrusted Markdown with the html.Safelink flag (the URL-sanitizing hardening flag itself introduces the crash); or (2) any downstream that calls the exported parser.IsSafeURL on a 0/1/2-byte attacker URL, no flag required. No recover() anywhere, so an uncaught crash of the calling goroutine. ## Verification EXECUTED with negative controls. Direct: the empty/1/2-char cases panic with the exact slice-bounds message while "/" returns true. End to end via ToHTML with html.CommonFlags|html.Safelink: `[x]()` panics, while `[x](/)`, `[x](http://example.com)`, plain text, and `[x](javascript:alert(1))` (safely dro