Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: thephpleague commonmark 2.8.4 Clear all filters
TI-2026-59143 CVE-2026-86435 · GHSA-2cmp-7fm4-4v9w

commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote

Priority MEDIUM 44

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00488 Published 2026-09-07 Fixed in 2.8.4 CWE-407
TI-2026-59142 CVE-2026-86434 · GHSA-jcmh-chhq-rh2x

commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision

Priority MEDIUM 44

league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision,…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00509 Published 2026-09-07 Fixed in 2.8.4 CWE-407
TI-2026-59141 CVE-2026-86433 · GHSA-f9pm-gcpp-fwjp

commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes

Priority MEDIUM 44

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00509 Published 2026-09-07 Fixed in 2.8.4 CWE-407
TI-2026-59140 CVE-2026-86432 · GHSA-f58g-hmv8-g97m

commonmark 2.0.0 before 2.8.4 Denial of Service via XML

Priority LOW 37

commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00418 Published 2026-09-07 Fixed in 2.8.4 CWE-405