All vulnerabilities
CVE-2026-105830GHSA-3q6v-r5mr-hxv8

league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser

thephpleague commonmarkPackagistLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 8 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.10.2Fixed versionCVE List
Published8 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

  • 2.10.2commonmarkCVE List
  • 2.10.2league/commonmark, PackagistOSVcomposer require "league/commonmark:^2.10.2"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU.

Text from CVE List

Affected versions 51

  • commonmarkaffected: 2.0.0 before 2.10.2CVE List
  • commonmarkunaffected: 2.10.2CVE List
  • league/commonmark, Packagistfrom 2.0.0, fixed in 2.10.2OSV
  • league/commonmark, Packagist2.0.0OSV
  • league/commonmark, Packagist2.0.1OSV
  • league/commonmark, Packagist2.0.2OSV
  • league/commonmark, Packagist2.0.3OSV
  • league/commonmark, Packagist2.0.4OSV
  • league/commonmark, Packagist2.1.0OSV
  • league/commonmark, Packagist2.1.1OSV
  • league/commonmark, Packagist2.1.2OSV
  • league/commonmark, Packagist2.1.3OSV
  • league/commonmark, Packagist2.10.0OSV
  • league/commonmark, Packagist2.10.1OSV
  • league/commonmark, Packagist2.2.0OSV
  • league/commonmark, Packagist2.2.1OSV
  • league/commonmark, Packagist2.2.2OSV
  • league/commonmark, Packagist2.2.3OSV
  • league/commonmark, Packagist2.2.4OSV
  • league/commonmark, Packagist2.2.5OSV
  • league/commonmark, Packagist2.3.0OSV
  • league/commonmark, Packagist2.3.1OSV
  • league/commonmark, Packagist2.3.2OSV
  • league/commonmark, Packagist2.3.3OSV
  • league/commonmark, Packagist2.3.4OSV
  • league/commonmark, Packagist2.3.5OSV
  • league/commonmark, Packagist2.3.6OSV
  • league/commonmark, Packagist2.3.7OSV
  • league/commonmark, Packagist2.3.8OSV
  • league/commonmark, Packagist2.3.9OSV
  • league/commonmark, Packagist2.4.0OSV
  • league/commonmark, Packagist2.4.1OSV
  • league/commonmark, Packagist2.4.2OSV
  • league/commonmark, Packagist2.4.3OSV
  • league/commonmark, Packagist2.4.4OSV
  • league/commonmark, Packagist2.5.0OSV
  • league/commonmark, Packagist2.5.1OSV
  • league/commonmark, Packagist2.5.2OSV
  • league/commonmark, Packagist2.5.3OSV
  • league/commonmark, Packagist2.6.0OSV
  • league/commonmark, Packagist2.6.1OSV
  • league/commonmark, Packagist2.6.2OSV
  • league/commonmark, Packagist2.7.0OSV
  • league/commonmark, Packagist2.7.1OSV
  • league/commonmark, Packagist2.8.0OSV
  • league/commonmark, Packagist2.8.1OSV
  • league/commonmark, Packagist2.8.2OSV
  • league/commonmark, Packagist2.8.3OSV
  • league/commonmark, Packagist2.9.0OSV
  • league/commonmark, Packagist2.9.1OSV
  • league/commonmark, Packagist2.9.2OSV

References 2