Key points
- CVE-2026-105830 affects thephpleague/commonmark versions 2.0.0 through 2.10.1.
- The flaw allows unauthenticated denial-of-service via specific markdown input patterns.
- A fix is available in version 2.10.2.
The short version
- Thephpleague/commonmark contains a high-severity denial-of-service vulnerability (CVSS 8.7).
- The issue stems from quadratic-time complexity in the GitHub Flavored Markdown Table extension.
- Developers should update to version 2.10.2 to mitigate CPU exhaustion risks.
The details
The NVD record for CVE-2026-105830 identifies a vulnerability in the thephpleague/commonmark library, specifically affecting versions from 2.0.0 up to, but not including, 2.10.2. The issue is classified as a Resource Exhaustion weakness (CWE-400) with a CVSS score of 8.7, which falls into the high severity range.
The vulnerability resides in the `TableStartParser::tryStart()` block within the GitHub Flavored Markdown Table extension. When the parser processes specific types of input, it performs repeated full-buffer `strpos` scans. This behavior creates a quadratic-time complexity issue. An unauthenticated attacker can trigger this by submitting a large paragraph consisting of lines that do not start with letters and contain no pipe characters. This input forces the PHP worker to perform excessive computational tasks, ultimately exhausting the CPU resources of the server hosting the application.
The context
This vulnerability is among the highest-rated issues published in recent CVE daily records. Our data desk analysis of the CVE Program's public record feed shows 382 new records in the last 24 hours, with 12 rated CVSS 8.0 or higher. CVE-2026-105830 ranks fifth among the highest scores, trailing behind CVE-2026-14269 (IBM DataPower Gateway, 9.8), CVE-2026-9209 (mJob, 9.3), CVE-2026-107640 (Integrics Enswitch, 9.3), and CVE-2026-105436 (MainWP Child, 8.8).
Other vendors appearing in the high-severity category include Obsidian, ImageMagick, CISA, and IBM. The presence of a high-severity flaw in a widely used PHP library like commonmark underscores the importance of monitoring dependencies for algorithmic complexity issues, particularly those involving text parsing.
What should you do?
- Update thephpleague/commonmark to version 2.10.2 or later.
- Review input validation for markdown processing endpoints to limit payload size.
- Monitor server CPU usage for anomalies indicative of resource exhaustion attacks.
What to do and how to stay safe: thephpleague
- Automation eliminates human delay but increases the risk of deploying untested code into production.
- Silent failures in update mechanisms can leave systems unprotected without triggering alerts.
- Version pinning prevents automatic upgrades from breaking dependent services or APIs.
Automatic updates reduce exposure time but require rigorous testing and rollback capabilities to prevent service disruption. Implement version pinning and signature verification to maintain control over your software environment.
Step-by-step guide: Automatic Software Updates: 8 FAQs on Security and Risk
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of commonmark are affected by CVE-2026-105830?
Versions from 2.0.0 before 2.10.2 are affected.
What is the CVSS score for this vulnerability?
The CVSS score is 8.7, which is rated as high severity.
How can an attacker exploit this flaw?
Attackers can submit a large paragraph of pipe-free lines not starting with letters to trigger CPU exhaustion.
