How do pipe-free lines in commonmark tables cause quadratic CPU scans in PHP apps?

A high-severity denial-of-service vulnerability in the popular PHP Markdown parser commonmark allows unauthenticated attackers to exhaust server CPU resources. The flaw, tracked as CVE-2026-105830, resides in the library’s handling of GitHub Flavored Markdown tables and impacts versions from 2.0.0 up to, but not including, 2.10.2. With a CVSS score of 8.7, the issue poses a significant risk to applications relying on this library for content rendering.

What is the technical root cause of the vulnerability?

The issue originates in the `TableStartParser::tryStart()` method within the GitHub Flavored Markdown Table extension. Specifically, the block-start scanning logic exhibits quadratic-time complexity when processing certain input patterns. Instead of efficiently determining whether a line starts a table, the parser performs repeated full-buffer `strpos` scans. This inefficiency escalates rapidly as the input size grows, causing the processing time to increase disproportionately.

How can an attacker exploit this flaw?

An attacker does not need authentication to trigger the denial-of-service condition. By submitting a large paragraph of text that consists of lines without pipes and does not start with letters, the attacker forces the parser into its inefficient scanning loop. These specific inputs cause the `tryStart()` function to repeatedly search the entire buffer for table-starting patterns. The cumulative effect of these repeated scans exhausts the CPU cycles of the PHP worker process, effectively freezing the server or making the application unresponsive to legitimate users.

Which components and versions are affected?

The vulnerability affects the `league/commonmark` library, a widely used PHP tool for parsing Markdown. Specifically, any version starting from 2.0.0 and continuing through those immediately preceding 2.10.2 is vulnerable. Applications that utilize this library to render user-submitted Markdown content, particularly those employing the GitHub Flavored Markdown table syntax, are at risk. The National Vulnerability Database classifies the weakness under CWE-400, which denotes unrestricted resource consumption.

What is the broader context of recent CVE disclosures?

This vulnerability emerged during a period of heightened disclosure activity. According to our data desk analysis of public records, 382 new CVEs were recorded in a 24-hour window, with 12 rated at CVSS 8.0 or higher. Among high-severity issues, the commonmark flaw scored 8.7, placing it among the top-rated vulnerabilities alongside issues affecting IBM DataPower Gateway, mJob, and MainWP. The top vendors for high-severity CVEs in this batch included Obsidian, ImageMagick, CISA, MainWP, mJob, and IBM.

What to do and how to stay safe: CVE-2026-105830

• Review your application dependencies to identify if you are using `league/commonmark` versions prior to 2.10.2.
• If you cannot update immediately, consider disabling Markdown table parsing for untrusted user input.
• Monitor server CPU usage metrics for sudden spikes that may indicate an ongoing denial-of-service attempt.
• Implement rate limiting on endpoints that accept user-generated Markdown content to mitigate resource exhaustion.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is there a patch available for CVE-2026-105830?

The source material indicates that versions prior to 2.10.2 are affected, implying that version 2.10.2 or later contains the fix.

What CVSS score was assigned to this vulnerability?

The vulnerability has a CVSS score of 8.7, which is classified as high severity.

Does the attacker need to be logged in to exploit this?

No, the vulnerability can be exploited by unauthenticated attackers through submitted input data.