PHP Library Parsing Vulnerability in League/Commonmark by The PHP League
CVE-2026-71488
7.5HIGH
What is CVE-2026-71488?
The League/Commonmark library, utilized for parsing and rendering CommonMark Markdown, exhibited a vulnerability in versions ranging from 0.6.0 to 2.9.0. This flaw allows specially crafted Markdown lines to cause quadratic time complexity during parsing, significantly affecting server performance. Attackers can exploit this vulnerability by submitting malicious Markdown for conversion, leading to excessive CPU consumption from a seemingly small request. This issue has been resolved in version 2.9.0, and it is crucial for users to update to this version to mitigate potential risks.
Affected Version(s)
commonmark >= 0.6.0, < 2.9.0