Denial of Service Vulnerability in CommonMark by The PHP League
CVE-2026-105830

8.7HIGH

Key Information:

Vendor

ThePHPleague

Status
Commonmark
Vendor
CVE Published:
8 October 2026

What is CVE-2026-105830?

The commonmark library developed by The PHP League contains a vulnerability that allows unauthenticated attackers to exploit the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() method. By inputting large unformatted text, attackers can initiate exhaustive CPU resource consumption through repeated full-buffer strpos scans. This can lead to service degradation affecting system availability. It is crucial for users of affected versions prior to 2.10.2 to perform timely updates to mitigate this vulnerability.

Affected Version(s)

commonmark 2.0.0 < 2.10.2

commonmark 2.10.2

References

https://github.com/thephpleague/commonmark/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/league-commonmark-2....
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
manus-use
.