CVE-2026-105830: league/commonmark Table Parser DoS Flaw

CVE-2026-105830 Overview

CVE-2026-105830 is a denial of service vulnerability in the league/commonmark PHP Markdown parser. The flaw affects versions 2.0.0 through 2.10.1 and resides in the GitHub Flavored Markdown (GFM) Table extension. Specifically, the TableStartParser::tryStart() block-start scan performs repeated full-buffer strpos scans on crafted input. An unauthenticated attacker can submit a large paragraph of pipe-free lines that do not begin with letters, triggering quadratic-time processing that exhausts PHP worker CPU. The issue is classified under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
Remote, unauthenticated attackers can exhaust PHP worker CPU and render Markdown-processing endpoints unavailable by submitting crafted input to any surface that renders user-supplied Markdown with the GFM Table extension enabled.

Affected Products

league/commonmark version 2.0.0 through 2.10.1
Applications using the GitHub Flavored Markdown Table extension
PHP web applications accepting untrusted Markdown input

Discovery Timeline

2026-10-08 - CVE-2026-105830 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-105830

Vulnerability Analysis

The vulnerability lives in the GFM Table extension's TableStartParser::tryStart() method. During block parsing, CommonMark evaluates each paragraph line to decide whether a table block is beginning. The table start scanner performs strpos searches across the full accumulated buffer when encountering lines that lack a leading letter and do not contain pipe characters.

For each additional line in the paragraph, the parser rescans the entire buffer rather than incrementally advancing. This produces O(n²) complexity relative to the paragraph size. A moderately sized input of pipe-free, non-letter-leading lines consumes disproportionate CPU time on the PHP worker that handles the request.

Because league/commonmark is widely used in content management systems, forums, API documentation portals, and chat applications, any endpoint rendering untrusted Markdown with the Table extension enabled is exposed.

Root Cause

The root cause is an algorithmic complexity defect in the table block-start detection logic. The parser was not designed with worst-case input assumptions and relied on repeated linear scans instead of bounded or incremental lookups. The GFM Table extension enables these scans by default, so applications inherit the complexity bug without any opt-in configuration.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker submits a crafted Markdown payload — a large paragraph of lines that are pipe-free and begin with non-letter characters — to any endpoint that invokes CommonMark rendering. The PHP worker spends excessive CPU time inside TableStartParser::tryStart(), blocking the request and reducing throughput for legitimate users. Repeated submissions can saturate available worker processes.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-3q6v-r5mr-hxv8 and the VulnCheck Advisory for CommonMark for additional technical detail.

Detection Methods for CVE-2026-105830

Indicators of Compromise

Elevated PHP-FPM or Apache worker CPU utilization tied to Markdown-rendering routes
HTTP requests containing large text bodies with many short lines lacking pipe characters and starting with punctuation or digits
Request latency spikes or timeouts on endpoints that accept Markdown input
Repeated POST or PUT requests from a small set of source IPs to Markdown-processing endpoints

Detection Strategies

Inspect application and web server logs for long request durations on Markdown rendering routes
Baseline normal payload size and line patterns for Markdown-accepting endpoints and alert on anomalies
Deploy a web application firewall rule that flags Markdown payloads exceeding a size threshold or showing extreme line-count-to-content ratios
Monitor PHP opcode or process-level CPU time attributable to League\CommonMark call stacks via APM tooling

Monitoring Recommendations

Alert on sustained PHP worker CPU saturation combined with 5xx or timeout error spikes
Track league/commonmark version inventory across repositories and container images using Software Composition Analysis
Correlate request source IPs with reputation feeds and rate-limit abusive clients
Review Composer dependency manifests to confirm transitive pulls of vulnerable versions

How to Mitigate CVE-2026-105830

Immediate Actions Required

Upgrade league/commonmark to version 2.10.2 or later using Composer
Audit all applications and dependencies for transitive use of vulnerable versions
Apply request body size limits and timeouts at the web server and application layer
Rate-limit anonymous requests to endpoints that render Markdown

Patch Information

The maintainers of thephpleague/commonmark fixed the quadratic scan in version 2.10.2. Update the dependency with composer require league/commonmark:^2.10.2 and redeploy affected services. Refer to the GitHub Security Advisory GHSA-3q6v-r5mr-hxv8 for the full fix commit and release notes.

Workarounds

Disable the GFM Table extension in CommonMark environment configuration if the feature is not required
Enforce a strict maximum size on incoming Markdown bodies at the reverse proxy or application layer
Add per-request CPU and execution-time limits in PHP, such as max_execution_time and request_terminate_timeout
Place Markdown rendering behind authenticated routes where feasible to reduce the anonymous attack surface

bash

# Configuration example: upgrade league/commonmark via Composer
composer require league/commonmark:^2.10.2
composer update league/commonmark

# Verify installed version
composer show league/commonmark | grep versions