Commonmark
Approved changes feed: RSS · Atom
cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Thephpleague (04d2ea8d-6c04-5d58-b17e-92c7b2478499) |
|---|---|
| Product | Commonmark (55ac6a2c-bbee-58ee-a045-03e03a7fba6d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/thephpleague/commonmark |
purl2cpe | 2026-06-01 10:15:11.666852 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-58382 |
vulnerable | 2026-09-16 04:46:27.048254 |
league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
HIGH (7.5)
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
Published: 2026-09-09T13:31:56.196Z
Updated: 2026-10-08T15:21:13.339Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-71488 |
vulnerable | 2026-09-16 04:32:59.224818 |
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
HIGH (7.5)
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.
Published: 2026-08-06T20:37:17.488Z
Updated: 2026-08-07T17:17:05.299Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86432 |
vulnerable | 2026-09-16 04:32:58.925565 |
commonmark 2.0.0 before 2.8.4 Denial of Service via XML
MEDIUM (5.3)
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
Published: 2026-09-07T12:53:51.897Z
Updated: 2026-10-08T15:25:53.380Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86433 |
vulnerable | 2026-09-16 04:32:58.720512 |
commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
HIGH (7.5)
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources.
Published: 2026-09-07T12:53:52.562Z
Updated: 2026-10-08T15:25:53.980Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86435 |
vulnerable | 2026-09-16 04:32:58.618323 |
commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
HIGH (7.5)
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.
Published: 2026-09-07T12:53:53.897Z
Updated: 2026-10-08T15:25:55.155Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86429 |
vulnerable | 2026-09-16 04:32:58.610603 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86431 |
vulnerable | 2026-09-16 04:32:58.596717 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86434 |
vulnerable | 2026-09-16 04:32:58.540295 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86428 |
vulnerable | 2026-09-16 04:32:58.539557 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86430 |
vulnerable | 2026-09-16 04:32:58.522887 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33347 |
vulnerable | 2026-06-08 07:59:09.742580 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-30838 |
vulnerable | 2026-06-08 07:57:14.349411 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46734 |
vulnerable | 2026-06-08 07:27:08.732767 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10010 |
vulnerable | 2026-06-08 05:12:21.909129 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-20583 |
vulnerable | 2026-06-08 05:11:27.567008 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.