league/commonmark: Quadratic denial of service in GFM table parser
Summary
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service flaw in the GitHub Flavored Markdown Table extension. The block-start scan rescans the whole paragraph buffer on every line. An unauthenticated attacker can send one large paragraph of pipe-free lines that do not start with a letter, which exhausts PHP worker CPU and can make the service unresponsive. The Table extension is enabled by default in the GFM bundle, so applications that render untrusted Markdown are affected even if they do not use tables.
Affected
- league/commonmark from 2.0.0 before 2.10.2
- The vendor advisory lists the range as up to 2.10.1
- Affected function: TableStartParser::tryStart (GFM Table extension)
Fixed in
- Upgrade to 2.10.2 or later (2.10.2 is the upstream fix; later versions 2.10.3 and 2.10.4 are reported in downstream projects but were not verified against the upstream release list)
Workaround
- Limit the size of untrusted Markdown accepted for conversion
- Disable the Table extension for untrusted input where practical
- These measures reduce exposure but do not remove the vulnerable code path; upgrading is the real fix
Exploitation
- CISA SSVC: exploitation status 'poc', automatable 'yes', technical impact 'partial'
- The GitHub advisory includes a short reproduction script, so the trigger is public
- No in-the-wild exploitation found; CISA KEV status not verified
- The attack needs no authentication and no user interaction
Our recommendation
- Find all PHP projects and Composer lock files that include league/commonmark, including transitive dependencies (for example via laravel/framework)
- Upgrade to 2.10.2 or later as soon as possible
- Where an upgrade must wait, cap the size of Markdown input and disable the Table extension for untrusted content
- Monitor request load and PHP worker usage on affected services
- Recheck NVD and CISA KEV, as the NVD entry was still awaiting analysis
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3q6v-r5mr-hxv8 github.com
- VulnCheck advisory www.vulncheck.com
- OSV GHSA-3q6v-r5mr-hxv8 osv.dev
- GitLab advisory mirror advisories.gitlab.com
- Ubuntu CVE tracker ubuntu.com
- CVEReports analysis cvereports.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:17.
Original description (NVD)
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.