CVE-2026-71488
Last modified
CVE-2026-71488 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| thephpleague | commonmark | >= 0.6.0, < 2.9.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-71488?
How severe is CVE-2026-71488?
How do I fix CVE-2026-71488?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-7147A vulnerability was detected in JoeCastrom mcp-chat-studio u…7.3
- CVE-2026-71474A flaw was found in insights-client. When the application re…6.3
- CVE-2026-71475A flaw was found in insights-client. A compromised managed c…5
- CVE-2026-71476Nx is a monorepo solution for TypeScript and polyglot codeba…8.7
- CVE-2026-71478league/commonmark is a PHP library for parsing and rendering…6.1
- CVE-2026-7148A flaw has been found in CodeAstro Online Classroom 1.0. Thi…6.3
- CVE-2026-7149A vulnerability has been found in dexhunter kaggle-mcp up to…7.3
- CVE-2026-71497jsoup is a Java library for working with real-world HTML. Fr…4.7
- CVE-2026-71498node-re2 provides RE2 regular expression bindings for Node.j…5.1
- CVE-2026-7150A vulnerability was found in dh1011 auto-favicon up to f1891…6.3
- CVE-2026-71502CTI-Transmute contains a stored cross-site scripting vulnera…5.1
- CVE-2026-7151A vulnerability was determined in Tenda HG3 2.0. Impacted is…8.8
Are you affected by CVE-2026-71488?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST