CVE-2026-71488
Last modified
CVE-2026-71488 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| thephpleague | commonmark | >= 0.6.0, < 2.9.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-71488?
How severe is CVE-2026-71488?
How do I fix CVE-2026-71488?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-71477mise manages dev tools like node, python, cmake, and terrafo…6.7
- CVE-2026-71478league/commonmark is a PHP library for parsing and rendering…6.1
- CVE-2026-71479New API is a large language mode (LLM) gateway and artificia…9.1
- CVE-2026-7148A flaw has been found in CodeAstro Online Classroom 1.0. Thi…6.3
- CVE-2026-71485Centrifugo is an open-source scalable real-time messaging se…9.1
- CVE-2026-71486vLLM is an inference and serving engine for large language m…4.3
- CVE-2026-7149A vulnerability has been found in dexhunter kaggle-mcp up to…7.3
- CVE-2026-71491sqlparse is a non-validating SQL parser module for Python. P…8.7
- CVE-2026-71492Banks generates meaningful LLM prompts using a simple templa…6
- CVE-2026-71493Infracost provides cloud cost intelligence for engineers, AI…5.9
- CVE-2026-71494Infracost provides cloud cost intelligence for engineers, AI…5.9
- CVE-2026-71497jsoup is a Java library for working with real-world HTML. Fr…4.7
Are you affected by CVE-2026-71488?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST