CVE-2026-105830 in CommonMark
Summary
by MITRE • 10/08/2026
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The league/commonmark library, specifically versions prior to 2.10.2, contains a critical quadratic-time denial of service vulnerability within its GitHub Flavored Markdown Table extension. This flaw resides in the internal logic governing block-level parsing, particularly affecting the TableStartParser::tryStart() method which is responsible for identifying and initializing table structures during markdown processing. The vulnerability arises from an inefficient algorithmic approach used to scan input buffers for potential table starts, leading to excessive computational overhead when processing specific malformed or adversarial inputs.
The technical root cause of this issue involves how the parser handles lines that do not conform to standard table syntax but still trigger partial parsing attempts. When an attacker submits a large paragraph consisting of pipe-free lines that do not start with letters, the parser enters a state where it repeatedly performs full-buffer string position searches using strpos operations. Each line in such a malicious input forces the engine to scan the entire accumulated buffer from the beginning to determine if a table structure exists. As the input size grows linearly, the number of characters scanned increases quadratically because each new line triggers a re-scan of all previously processed content without caching or optimization for non-matching patterns.
This algorithmic inefficiency results in severe performance degradation that can be exploited by unauthenticated attackers to cause a denial of service condition. By submitting carefully crafted markdown documents with thousands of such lines, an attacker can force the PHP worker process to consume nearly one hundred percent of available CPU resources indefinitely. The impact is particularly acute in web applications where commonmark is used as part of request handling pipelines, as this resource exhaustion can lead to server unresponsiveness, timeout errors for legitimate users, and potential cascading failures across clustered environments relying on shared compute resources.
From a classification perspective, this vulnerability aligns with CWE-400 Uncontrolled Resource Consumption, specifically manifesting through inefficient algorithmic complexity that allows an attacker to trigger disproportionate resource usage relative to input size. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques associated with Impact and potentially Execution phases where adversaries aim to degrade service availability by exploiting software logic flaws rather than crashing applications directly. The lack of authentication requirements for triggering this vulnerability makes it particularly dangerous in public-facing web services that accept user-generated markdown content without strict input validation or rate limiting mechanisms at the application layer.
Mitigation strategies primarily involve upgrading the league/commonmark library to version 2.10.2 or later, where developers have addressed the quadratic complexity by optimizing the table parsing logic and implementing more efficient buffer scanning techniques. For organizations unable to immediately patch their dependencies, defensive coding practices such as limiting input size for markdown processing, enforcing strict rate limits on endpoints accepting user-generated content, and deploying web application firewalls with rules targeting excessive CPU consumption patterns can provide temporary relief. Additionally, configuring PHP worker timeouts and memory limits appropriately ensures that even if an attack is attempted, the impact remains contained within isolated processes rather than affecting the entire server infrastructure.