535 matches found
PT-2026-86800
Name of the Vulnerable Software and Affected Versions league/commonmark versions 2.0.0 through 2.8.3 Description A denial of service issue exists in the UniqueSlugNormalizer::normalize function. The problem occurs when the function restarts its numeric-suffix search from 1 during every slug...
PT-2026-86796
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...
Linux Distros Unpatched Vulnerability : CVE-2026-86431
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an...
Linux Distros Unpatched Vulnerability : CVE-2026-86434
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its...
Linux Distros Unpatched Vulnerability : CVE-2026-86430
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and...
CVE-2026-86434: Inefficient Algorithmic Complexity
league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...
PT-2026-84648
🟠 league/commonmark Denial of Service DoS via Algorithmic Complexity, CVE-2025-23029 Medium -DC-Sep2026-2072 https://t.co/4GpShw74kC...
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
Impact AttributesExtension ships with the library but must be explicitly registered on the Environment; it is not included in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension. Applications that do not register AttributesExtension are not affected by this...
GHSA-8RR7-CVQ3-GMFH league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
Impact AttributesExtension ships with the library but must be explicitly registered on the Environment; it is not included in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension. Applications that do not register AttributesExtension are not affected by this...
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
Impact Two first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitly registered on the Environment; neither is included in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension. Applications that do not register...
GHSA-JJV6-8J6V-6J52 league/commonmark: Denial of service in the SmartPunct and Attributes extensions
Impact Two first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitly registered on the Environment; neither is included in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension. Applications that do not register...
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
Summary The AttributesExtension documents a security guarantee: Note: Attributes starting with on e.g. onclick or onerror are capable of executing JavaScript code and are therefore never allowed by default. You must explicitly add them to the allow list if you want to use them. —...
GHSA-F8FG-PG57-V4J8 league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
Summary The AttributesExtension documents a security guarantee: Note: Attributes starting with on e.g. onclick or onerror are capable of executing JavaScript code and are therefore never allowed by default. You must explicitly add them to the allow list if you want to use them. —...
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Impact Affected versions of league/commonmark perform super-linear work on three independent parsing paths, all of which are reachable on a stock new CommonMarkConverter with default configuration and no extensions registered. Each trigger fits on a single line of input, so no complex Markdown...
GHSA-J8PM-GJ4C-RQ4X league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Impact Affected versions of league/commonmark perform super-linear work on three independent parsing paths, all of which are reachable on a stock new CommonMarkConverter with default configuration and no extensions registered. Each trigger fits on a single line of input, so no complex Markdown...
CLSA-2026-1788257590 TuxCare security update for league/commonmark (6 CVEs)
TuxCare rebuilt league/commonmark to address 6 CVEs. Fixed in 2.7.1-p2+tuxcare...
CLSA-2026-1788257456 TuxCare security update for league/commonmark (6 CVEs)
TuxCare rebuilt league/commonmark to address 6 CVEs. Fixed in 2.8.2-p2+tuxcare...
CLSA-2026-1788257350 TuxCare security update for league/commonmark (4 CVEs)
TuxCare rebuilt league/commonmark to address 4 CVEs. Fixed in 1.6.7-p4+tuxcare...