CVE-2026-71488 league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-71488

The CVE concerns league/commonmark (PHP) with a vulnerability in versions 0.6.0–2.9.0 where crafted Markdown can trigger quadratic-time processing during parsing/conversion. The root cause involves repeatedly rescanning growing segments to translate character positions to byte positions, and the ...