Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: thephpleague commonmark 2.9.1 Clear all filters
TI-2026-59138 CVE-2026-86430 · GHSA-hxrj-xxg4-w3qp

league/commonmark before 2.9.1 Denial of Service via parsing

Priority MEDIUM 44

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00493 Published 2026-09-07 Fixed in 2.9.1 CWE-407
TI-2026-59137 CVE-2026-86429 · GHSA-7x8h-jg2x-pjm5

commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes

Priority MEDIUM 44

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00515 Published 2026-09-07 Fixed in 2.9.1 CWE-407