CVE-2026-71488

The CVE concerns league/commonmark (PHP) with a vulnerability in versions 0.6.0–2.9.0 where crafted Markdown can trigger quadratic-time processing during parsing/conversion. The root cause involves repeatedly rescanning growing segments to translate character positions to byte positions, and the ...