Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
🔴 league/commonmark, Denial of Service (ReDoS), #CVE-2026-71488 (High) -DC-Sep2026-2084 https://dailycve.com/league-commonmark-denial-of-service-redos-cve-2026-71488-high-dc-sep2026-2084/
Post summary
The DailyCVE entry announces a new high‑severity ReDoS denial‑of‑service vulnerability (CVE‑2026‑71488) affecting league/commonmark.
🚨HIGH - league/commonmark Quadratic-Time Markdown Parsing DoS (CVE-2026-71488) league/commonmark 0.6.0-2.8.3 can hit quadratic-time parsing on specially crafted Markdown lines due to repeated rescanning to map character<->byte positions; enabling the Autolink extension adds extra overhead. Untrusted Markdown input can spike CPU/allocations, exhausting PHP workers and causing DoS. 👉Affected: league/commonmark 0.6.0-2.8.3 | Upgrade to 2.9.0
Post summary
The post announces a DoS vulnerability (CVE‑2026‑71488) in league/commonmark due to quadratic‑time parsing, and advises upgrading to version 2.9.0 as a fix.