Description
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU.
Published: 2026-10-08
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

league/commonmark from version 2.0.0 up to but not including 2.10.2 contains a quadratic‑time denial‑of‑service flaw in the TableStartParser::tryStart() routine. Unauthenticated users can submit a paragraph composed of pipe‑free lines that do not begin with letters, forcing the parser to repeatedly scan the entire buffer with strpos and rapidly consume CPU resources. The weakness is a classic resource exhaustion problem identified as CWE‑400.

Affected Systems

The affected product is thephpleague commonmark. Any installation of the library in the version range 2.0.0 through 2.10.1 is vulnerable; version 2.10.2 and later contain the fix.

Risk and Exploitability

The vulnerability has a CVSS score of 8.7, indicating a high severity. EPSS is not available and the flaw is not listed in the CISA KEV catalog. Attackers need no authentication and can exploit the issue by feeding large amounts of specially crafted markdown content to any service that uses commonmark. Because the flaw is purely computational, it can be triggered remotely and will cause a denial of service by exhausting PHP worker CPU.

Generated by OpenCVE AI on October 8, 2026 at 15:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the league/commonmark library to version 2.10.2 or later.
  • If an upgrade is not immediately possible, disable or remove the GitHub Flavored Markdown Table extension to prevent the problematic parser from executing.
  • Implement application‑level rate limiting or resource throttling on endpoints that process markdown to mitigate the impact of repeated DoS attempts.

Generated by OpenCVE AI on October 8, 2026 at 15:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU.
Title league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser
First Time appeared Thephpleague
Thephpleague commonmark
Weaknesses CWE-400
CPEs cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:*
Vendors & Products Thephpleague
Thephpleague commonmark
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Thephpleague Commonmark
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-08T17:03:50.815Z

Reserved: 2026-10-05T21:59:09.591Z

Link: CVE-2026-105830

cve-icon Vulnrichment

Updated: 2026-10-08T17:03:25.566Z

cve-icon NVD

Status : Received

Published: 2026-10-08T15:17:35.340

Modified: 2026-10-08T17:17:12.843

Link: CVE-2026-105830

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T16:00:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption