Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-105830

league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

thephpleague commonmark

Default version status: unaffected

  • 2.0.0 to < 2.10.2affected
  • 2.10.2unaffected
pkg:composer/league/commonmark

References