Read the docs
TI-2026-69535 Aliases CVE-2026-105830GHSA-84wr-wccg-f5hp

league/commonmark Quadratic DoS via TableStartParser

Priority HIGH 77CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan (CWE-400). An unauthenticated attacker can submit a large paragraph of pipe-free lines that do not start with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU. CVSS 4.0 scores it 8.7 (HIGH), and CISA SSVC rates exploitation as poc, automatable as yes, and technical impact as partial. It is not in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix Fixed commonmark (thephpleague): 2.10.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
thephpleaguecommonmark2.0.0 to before 2.10.22.10.2Patch availableCNA
  • commonmark Vendorthephpleague Affected 2.0.0 to before 2.10.2 Fixed in 2.10.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:*——thephpleague
  • cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:* Versions — — ·thephpleague

Remediation

Upgrade league/commonmark to 2.10.2 or later, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA commonmark (thephpleague) Fixed in 2.10.2

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-105830
  2. 2026-10-08 Alias added: GHSA-84wr-wccg-f5hp
  3. 2026-10-08 CISA SSVC decision points changed
  4. 2026-10-08 Priority changed: MEDIUM → HIGH

References

Advisory 1

  • TI-2026-50093 league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes CVSS 3.1MEDIUM 6.1
  • TI-2026-69534 Cross-site scripting in League CommonMark bypasses DisallowedRawHtml CVSS 4.0MEDIUM 5.3
  • TI-2026-65445 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is… CVSS 3.1LOW 3.5
  • TI-2021-12376 Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem CVSS 3.1CRITICAL 9.8
  • TI-2026-59143 commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote CVSS 4.0HIGH 8.7
  • TI-2026-59142 commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision CVSS 4.0HIGH 8.7
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences