CVE-2026-71488

Name of the Vulnerable Software and Affected Versions league/commonmark versions 0.6.0 through 2.8.3

Description Specially crafted Markdown lines can cause the parser to exhibit quadratic time complexity during conversion. This occurs because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, which differ when UTF-8 characters use more than one byte. Additionally, the AutolinkExtension may copy and validate the remaining line at every URL-like prefix. An attacker can exploit this by submitting a small request containing a long line with non-ASCII characters, leading whitespace, or repeated Markdown punctuation to consume disproportionate CPU time and memory allocation. This can lead to a denial of service by occupying all available PHP workers. The issue affects CommonMarkConverter, GithubFlavoredMarkdownConverter, and environments using AutolinkExtension or GithubFlavoredMarkdownExtension.

Recommendations Update league/commonmark to version 2.9.0 or later. As a temporary workaround, reject or truncate inputs with excessively long individual lines before they are passed to the converter. Disable AutolinkExtension and avoid using GithubFlavoredMarkdownExtension to remove the autolink-specific trigger.