{"id":"CVE-2026-105830","published":"2026-10-08T15:17:35.340","lastModified":"2026-10-08T21:33:42.423","description":"league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":[],"products":[],"references":[{"url":"https://github.com/thephpleague/commonmark/security/advisories/GHSA-3q6v-r5mr-hxv8","tags":[]},{"url":"https://www.vulncheck.com/advisories/league-commonmark-2.0.0-before-2.10.2-quadratic-dos-via-tablestartparser","tags":[]},{"url":"https://github.com/thephpleague/commonmark/security/advisories/GHSA-3q6v-r5mr-hxv8","tags":[]}],"exploitRefs":[{"url":"https://github.com/thephpleague/commonmark/security/advisories/GHSA-3q6v-r5mr-hxv8","tags":[]},{"url":"https://github.com/thephpleague/commonmark/security/advisories/GHSA-3q6v-r5mr-hxv8","tags":[]}],"hasPoc":true,"ai":{"summary":"A quadratic-time denial of service vulnerability exists in league/commonmark's GitHub Flavored Markdown Table extension where processing large paragraphs without pipe characters can cause excessive CPU usage through repeated string scans, potentially leading to service unavailability.","exploitability":"Exploitation is straightforward for unauthenticated attackers who can submit specially crafted markdown content that triggers repeated full-buffer strpos scans, requiring no additional authentication or complex setup.","blast_radius":"The vulnerability could impact web applications using this library for markdown processing, potentially causing widespread service disruption when attackers submit malicious markdown content to endpoints that process user input.","remediation":"Upgrade to version 2.10.2 or later to remediate the quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","markdown","web","php"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:26:01.393Z"}}