Key points
- CVE-2026-105830 affects thephpleague commonmark versions prior to 2.10.2.
- The vulnerability is rated CVSS 8.7 (High) and involves resource exhaustion.
- Attackers exploit the GitHub Flavored Markdown Table extension's parsing logic.
Security teams should be aware of a high-severity denial-of-service vulnerability in the popular PHP library thephpleague commonmark. The flaw, tracked as CVE-2026-105830, allows unauthenticated attackers to exhaust server CPU resources by submitting specific markdown content. This issue impacts all versions of the library from 2.0.0 up to, but not including, 2.10.2.
In plain English
The vulnerability exists in how the library processes tables in GitHub Flavored Markdown. Specifically, the bug is located in the `TableStartParser::tryStart()` function, which scans text to determine if a line starts a table. When an attacker submits a large paragraph of lines that do not contain pipe characters and do not start with letters, the parser enters an inefficient loop.
Instead of quickly determining that these lines are not tables, the system performs repeated, full-buffer string searches using `strpos`. This behavior is described as quadratic-time complexity, meaning the processing time grows disproportionately with the size of the input. As the input grows, the PHP worker CPU becomes fully occupied, leading to a denial of service for other users or processes on the server.
The background
According to our data desk analysis of public CVE records, 382 new vulnerabilities were published in the last 24 hours. Among these, 12 were rated CVSS 8.0 or higher, and three were rated 9.0 or higher. The commonmark vulnerability is among the highest-rated issues in this batch, with a CVSS score of 8.7.
Other significant high-severity vulnerabilities published in the same window include CVE-2026-14269 affecting IBM DataPower Gateway (CVSS 9.8) and CVE-2026-9209 affecting mJob mJobTime (CVSS 9.3). The top vendors with high-severity records included Obsidian, ImageMagick, CISA, MainWP, mJob, and IBM. The commonmark issue is classified under CWE-400, which covers unrestricted resource consumption.
What changes now
Organizations using thephpleague commonmark versions before 2.10.2 are at risk. If your application processes untrusted markdown input, particularly content that might include large blocks of text resembling table structures without standard delimiters, you are exposed to CPU exhaustion attacks.
To mitigate this risk, update the library to version 2.10.2 or later. If an immediate update is not possible, consider restricting the size of markdown inputs or implementing rate limiting on endpoints that accept user-generated markdown. No other fixes or workarounds have been confirmed by the vendor outside of the version update.
What to do and how to stay safe: thephpleague commonmark
- Input validation failures allow attackers to inject malicious payloads that bypass standard security controls.
- Weak configuration hardening leaves default settings active, creating easy entry points for unpatched flaws.
- Network segmentation limits the blast radius when an unknown vulnerability is successfully exploited.
Security is not just about patching known flaws. You must reduce the attack surface and limit the impact of any breach.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
CVE-2026-105830 has a CVSS score of 8.7, which is rated as High severity.
Which versions of thephpleague commonmark are affected?
All versions from 2.0.0 before 2.10.2 are affected by this denial-of-service vulnerability.
How do attackers exploit this flaw?
Attackers submit a large paragraph of lines without pipe characters that do not start with letters, forcing inefficient string scans.
