CVE catalog
CVE-2026-71488
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when c
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.63% · Oct 25, 2026
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | php-league-commonmark | sid | 2.10.4-1 | fixed |
| Debian | php-league-commonmark | forky | 2.10.4-1 | fixed |
| Debian | php-league-commonmark | trixie | 2.7.0-1+deb13u1 | vulnerable |
| Debian | php-league-commonmark | bookworm | 2.3.9-1+deb12u1 | vulnerable |
| Composer | league/commonmark | Not reported | 2.9.0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | php-league-commonmark | source | sid | 2.9.0-1 | not yet assigned | Not reported | Not reported |
| Debian | php-league-commonmark | source | forky | 2.9.0-1 | not yet assigned | Not reported | Not reported |
| Debian | php-league-commonmark | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | php-league-commonmark | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Composer | league/commonmark | composer | Not reported | 2.9.0 | Not reported | Not reported | Not reported |
Notes
[trixie] php-league-commonmark: Minor issue [bookworm] php-league-commonmark: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [php-league-commonmark]Affected
Details (2)
2.3.9-1+deb12u1· all · bookwormAffected
nvd · php-league-commonmark · debian · bookworm; nvd · php-league-commonmark · debian · 12
2.3.9-1+deb12u1· all · bookwormAffected
nvd · php-league-commonmark · debian · bookworm; nvd · php-league-commonmark · debian · 12
[Debian 13 (Trixie)]
- [php-league-commonmark]Affected
Details (2)
2.7.0-1+deb13u1· all · trixieAffected
nvd · php-league-commonmark · debian · 13
2.7.0-1+deb13u1· all · trixieAffected
nvd · php-league-commonmark · debian · 13
Observed:
References
- [https://github.com/advisories/GHSA-2q4p-g7hv-5rgv]
- [https://github.com/thephpleague/commonmark/commit/a6ef6cdc308dfa39a34239c35818e75892a0e6a8]
- [https://github.com/thephpleague/commonmark/commit/a70979ea0d7d3377bd7127536748454a922bf5eb]
- [https://github.com/thephpleague/commonmark/commit/c97b02e5e652b992033b93ba5d6182f706343fc6]
- [https://github.com/thephpleague/commonmark/releases/tag/2.9.0]
- [https://github.com/thephpleague/commonmark/security/advisories/GHSA-2q4p-g7hv-5rgv]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-71488]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-71488]
- [https://security-tracker.debian.org/tracker/CVE-2026-71488]
[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]