league/commonmark: Quadratic-Time Denial of Service in GFM Table Extension (CVE-2026-105830)

What happened

A vulnerability tracked as CVE-2026-105830 (GHSA-3q6v-r5mr-hxv8) was published affecting league/commonmark, a PHP library for parsing Markdown. The issue is a quadratic-time denial-of-service flaw located in the block-start scan of the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() function.

Technical cause

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). According to the advisory, an attacker can submit a large paragraph consisting of pipe-free lines that do not start with letters. This input forces the TableStartParser::tryStart() function to repeatedly perform full-buffer strpos scans, resulting in quadratic-time processing that exhausts PHP worker CPU resources.

Why it matters

The vulnerability can be triggered by unauthenticated attackers without requiring any user interaction, meaning any application that passes untrusted user input to the CommonMark GFM Table extension could be exposed to CPU exhaustion and service degradation or outage.

Who is affected

Any application or service using league/commonmark with the GitHub Flavored Markdown Table extension enabled, within the affected version range, is potentially exposed. This includes PHP applications that render user-submitted Markdown content, such as comment systems, documentation tools, or content management platforms.

Affected versions

league/commonmark versions from 2.0.0 up to and including 2.10.1 are affected. Version 2.10.2 contains the fix.

Fixes and mitigation

The vulnerability is fixed in league/commonmark version 2.10.2. Users of affected versions (2.0.0 through 2.10.1) should update to 2.10.2 to resolve the issue.

Recommended action

Site owners and developers using league/commonmark should update to version 2.10.2 as soon as possible, particularly if the GitHub Flavored Markdown Table extension is enabled and the library processes untrusted or user-submitted Markdown input. Verify the update in dependency manifests (e.g., composer.lock) and redeploy affected services.