Key points
- CVE-2026-105830 is rated CVSS 8.7 HIGH severity.
- The flaw allows quadratic-time denial of service through pipe-free lines.
- Versions 2.0.0 through 2.10.1 are affected; 2.10.2 fixes the issue.
Developers using thethpleague commonmark must update their PHP applications immediately to prevent server resource exhaustion. A high-severity denial-of-service vulnerability in the popular Markdown parser allows unauthenticated attackers to freeze PHP worker processes by submitting specially crafted input. The National Vulnerability Database assigns this flaw CVE-2026-105830 with a CVSS score of 8.7, classifying it as HIGH severity.
The vulnerability stems from how the library handles GitHub Flavored Markdown tables. Specifically, the TableStartParser::tryStart() method performs a block-start scan that becomes inefficient under certain conditions. When an attacker submits a large paragraph consisting of pipe-free lines that do not start with letters, the parser forces repeated full-buffer strpos scans. This behavior creates a quadratic-time complexity problem, meaning the processing time increases exponentially with the size of the input, ultimately exhausting the CPU resources of the hosting server.
What we know
According to the NVD record, the issue affects versions of thethpleague commonmark from 2.0.0 up to, but not including, 2.10.2. The weakness is categorized under CWE-400, which covers uncontrolled resource consumption. The specific attack vector requires no authentication, making it accessible to any remote user who can submit content to a system utilizing this parser.
In the broader context of recent vulnerabilities, our data desk analysis of public records shows that 382 new CVE records were published in the last 24 hours. Among these, 12 were rated CVSS 8.0 or higher, and three reached the critical threshold of 9.0 or above. While CVE-2026-105830 is significant, it ranks below other high-severity issues such as CVE-2026-14269 in IBM DataPower Gateway (CVSS 9.8) and CVE-2026-9209 in mJob mJobTime (CVSS 9.3). However, for PHP developers, the commonmark flaw presents an immediate risk to application availability.
Defender's checklist
- Identify all instances of thethpleague commonmark in your project dependencies.
- Verify the current version installed on your servers.
- Confirm that the version is 2.10.2 or later.
- Review server logs for signs of unusual CPU spikes during form submissions.
What to do and how to stay safe: thephpleague
- Audit your dependency manager to ensure you are not pulling in vulnerable versions of the library.
- Implement rate limiting on endpoints that accept user-generated Markdown content to mitigate the impact of resource exhaustion.
- Monitor server CPU usage closely for sudden spikes that correlate with incoming traffic, which may indicate an active attack.
- Once the vendor provides an update, test the patch in a staging environment before deploying to production to ensure compatibility.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of thethpleague commonmark are affected?
Versions from 2.0.0 up to, but not including, 2.10.2 are vulnerable to this denial-of-service flaw.
How does the attack work?
Attackers submit large paragraphs of pipe-free lines that do not start with letters, forcing the parser to perform repeated full-buffer scans that exhaust CPU resources.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-105830 as HIGH with a CVSS score of 8.7.
