thephpleague commonmark Patch Fixes High-Severity DoS Vulnerability in Markdown Parser
A quadratic-time denial-of-service flaw in thephpleague commonmark allows unauthenticated attackers to exhaust PHP worker CPU resources via crafted input.
Key points
- CVE-2026-105830 affects thephpleague commonmark versions 2.0.0 through 2.10.1.
- The vulnerability is rated CVSS 8.7 (High) and stems from inefficient string scanning in table parsing.
- Version 2.10.2 contains the fix for this quadratic-time complexity issue.
The maintainers of thephpleague commonmark have released version 2.10.2 to address a high-severity denial-of-service vulnerability that allows unauthenticated attackers to exhaust server resources. The flaw, tracked as CVE-2026-105830, affects all versions of the library from 2.0.0 up to, but not including, 2.10.2.
At a glance
- New CVEs (24h)
- 382
- CVSS 8.0+
- 12
- Critical (9.0+)
- 3
The vulnerability exists within the GitHub Flavored Markdown Table extension, specifically in the `TableStartParser::tryStart()` block-start scan. According to the National Vulnerability Database (NVD), the issue is classified under CWE-400 (Uncontrolled Resource Consumption) and carries a CVSS score of 8.7, placing it in the "High" severity range.
An attacker can trigger the flaw by submitting a large paragraph consisting of pipe-free lines that do not start with letters. This specific input pattern forces the parser to perform repeated full-buffer `strpos` scans. Because the algorithm exhibits quadratic-time complexity, these operations rapidly exhaust the CPU of the PHP worker handling the request, leading to a denial of service.
Context in Recent Vulnerability Landscape
This disclosure appeared alongside a significant volume of new security advisories. Our data desk analysis of the CVE Program's public record feed indicates that 382 new CVE records were published in the last 24 hours. Among these new entries, 12 were rated with a CVSS score of 8.0 or higher, and three were rated 9.0 or higher.
The top vendors represented in the high-severity category for this period included Obsidian and ImageMagick, each with two entries, followed by CISA, MainWP, mJob, and IBM with one entry each. The highest-rated vulnerability in this batch was CVE-2026-14269, affecting IBM DataPower Gateway 10.6CD with a CVSS score of 9.8. Other high-severity findings included CVE-2026-9209 in mJob mJobTime (CVSS 9.3), CVE-2026-107640 in Integrics Enswitch (CVSS 9.3), and CVE-2026-105436 in MainWP MainWP Child (CVSS 8.8). The commonmark vulnerability (CVE-2026-105830) was among the notable high-severity releases during this window.
Who Is Affected
Developers and organizations using thephpleague commonmark library for PHP are affected if they are running versions 2.0.0 through 2.10.1. The library is widely used for parsing Markdown in web applications. The vulnerability specifically targets the table-parsing functionality introduced in the GitHub Flavored Markdown extension. Applications that allow unauthenticated users to submit Markdown content that is subsequently parsed by this library are at risk. The attack vector does not require authentication, meaning any user who can send input to the application can potentially trigger the resource exhaustion.
What should you do?
Users of thephpleague commonmark should update to version 2.10.2 immediately to mitigate this risk. This version contains the necessary code changes to resolve the quadratic-time complexity issue in the table parser. Until the update is applied, administrators may consider restricting the size of Markdown input allowed from unauthenticated users or disabling the table extension if it is not required for their application's functionality.
What to do and how to stay safe: thephpleague
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-105830?
The National Vulnerability Database rates CVE-2026-105830 as CVSS 8.7, which is classified as High severity.
Which versions of thephpleague commonmark are vulnerable?
All versions from 2.0.0 up to 2.10.1 are affected. Version 2.10.2 and later are not vulnerable.
How does an attacker exploit this vulnerability?
An attacker submits a large paragraph of pipe-free lines that do not start with letters, forcing the parser to perform inefficient repeated scans that exhaust CPU resources.
