thephpleague commonmark up to 2.8.x Autolink Extension resource consumption

Summaryinfo

A vulnerability identified as problematic has been detected in thephpleague commonmark up to 2.8.x. The affected element is an unknown function of the component Autolink Extension. The manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-71488. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in thephpleague commonmark up to 2.8.x and classified as problematic. This issue affects some unknown functionality of the component Autolink Extension. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-71488 since 08/06/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 2.9.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• thephpleague

Name

• commonmark

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8

Website

• Product: https://github.com/thephpleague/commonmark/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion