CVE-2026-105830— league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser
Quick assessment
Affected
thephpleague commonmark
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
league/commonmark 版本从 2.0.0 到 2.10.2（不含 2.10.2）存在一个二次时间复杂度（O(n²)）的拒绝服务漏洞，该漏洞出现在 GitHub Flavored Markdown（GFM）表格扩展的 TableStartParser::tryStart() 方法的块开始扫描逻辑中。未认证的攻击者可以提交一个由大量不含竖线（
Possible ATT&CK Techniques 2 AI
T1499 · Endpoint Denial of Service T1499.002 · Service Exhaustion Flood
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105830
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser
Source: CVE Program / CVE List V5
Vulnerability Description
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| thephpleague | commonmark | 2.0.0 ~ 2.10.2 | - |
|
II. Public POCs for CVE-2026-105830
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105830
请登录查看更多情报信息。
Other References for CVE-2026-105830 (2)
IV. Related Vulnerabilities
Same product: commonmark
-
CVE-2026-105829
League CommonMark 1.3.0 before 2.10.2 Stored XSS via Disallo -
CVE-2024-58382
league/commonmark before 2.6.0 Denial of Service via Quadrat -
CVE-2026-86435
commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote -
CVE-2026-86434
commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Co -
CVE-2026-86433
commonmark 1.5.0 before 2.8.4 Denial of Service via Attribut
Same vendor: thephpleague
-
CVE-2026-105829
League CommonMark 1.3.0 before 2.10.2 Stored XSS via Disallo -
CVE-2026-102601
Flysystem: WhitespacePathNormalizer's control-character (Cor -
CVE-2024-58382
league/commonmark before 2.6.0 Denial of Service via Quadrat -
CVE-2026-86435
commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote -
CVE-2026-86433
commonmark 1.5.0 before 2.8.4 Denial of Service via Attribut
Same weakness: CWE-400
-
CVE-2026-107294
Pydantic AI: Unbounded memory use when downloading remote co -
CVE-2026-61801
github.com/moby/sys/user has a possible DoS via unbounded pa -
CVE-2026-107287
Pydantic AI: Excessive resource use when local web fetching -
CVE-2026-105825
ImageMagick before 7.1.2-30 Denial of Service via Crafted XM -
CVE-2026-105402
ImageMagick before 7.1.2-31 Denial of Service via XMP Profil
V. Comments for CVE-2026-105830
No comments yet