CVE-2026-71488High· 7.5▾ Twilightleague/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing pa…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
league/commonmark >= 0.6.0, < 2.9.0Patched in:
league/commonmark 2.9.0Connected by shared product, vendor, weakness, or advisory.
GHSA-j8pm-gj4c-rq4xHigh· 7.5league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
GHSA-jjv6-8j6v-6j52High· 7.5league/commonmark: Denial of service in the SmartPunct and Attributes extensions
GHSA-8rr7-cvq3-gmfhHigh· 7.5league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
GHSA-g2gp-3wwq-f4phHigh· 7.5league/commonmark: Denial of service via adjacent inline attribute blocks
GHSA-jfm3-95jq-q3rfHigh· 7.5league/commonmark: Denial of service via duplicate footnote definitions
GHSA-mh25-x5hq-wrqpHigh· 7.5league/commonmark: Denial of service via colliding heading slugs