CVE-2026-71488 Details
Description
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.
A denial-of-service vulnerability has been identified in the League CommonMark library, specifically in versions 0.6.0 prior to 2.8.4. The issue arises from the parser's handling of multibyte characters in UTF-8, which can lead to quadratic time complexity during parsing. This vulnerability can be exploited by submitting specially crafted Markdown that takes advantage of the parser's character-to-byte position translation, causing excessive CPU usage and memory allocation. The problem is exacerbated when the Autolink extension is enabled, allowing for further manipulation of the parsing process.
Upgrade to League CommonMark version 2.9.0 or later, where this vulnerability has been fixed. If an immediate upgrade is not possible, consider implementing input validation to reject or truncate excessively long lines before parsing, and apply additional measures such as rate limiting and restricting Markdown processing to trusted users.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1050 | Excessive Platform Resource Consumption within a Loop | [email protected] |
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |