# league/commonmark quadratic DoS in GitHub Flavored Markdown table parser

Source: https://junglewise.ai/threats/league-commonmark-quadratic-time-denial-of-service-in-the-github-a4135205  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-09-30

league/commonmark is a PHP library that converts Markdown text to HTML, widely used in web applications and content management systems. The GitHub Flavored Markdown table extension contains a performance flaw where a single request with a large paragraph of plain text triggers quadratic CPU consumption that grows with the square of input size. An attacker can send a few megabytes of crafted Markdown to exhaust worker processes and deny service to legitimate users.

Technologies: [league/commonmark (Packagist)](https://junglewise.ai/threats/technologies/league-commonmark). Vendors: [League](https://junglewise.ai/threats/vendors/league), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 30 September 2026.

**Which products and versions are affected?** League Commonmark 2.0.0 to 2.10.1; league/commonmark (Packagist) >= 2.0.0, <= 2.10.1.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run League Commonmark or league/commonmark (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

TableStartParser::tryStart() calls strpos() on the entire accumulated paragraph buffer on every non-blank line, performing O(M²) work where M is the paragraph line count. The vulnerable code in src/Extension/Table/TableStartParser.php rescans the full buffer looking for a pipe character, even though only the last line can ever form a table header. Exploitation requires network access to an endpoint that parses untrusted Markdown with GithubFlavoredMarkdownConverter (or any configuration enabling TableExtension), and the attacker controls the Markdown input; no authentication or user interaction is needed.

## Affected products

- league commonmark 2.0.0 to 2.10.1

## Timeline

- 2026-09-30: disclosed: GHSA-3q6v-r5mr-hxv8 published

## Related threats

- [league/commonmark DisallowedRawHtml XSS bypass in tag parsing](https://junglewise.ai/threats/league-commonmark-disallowedrawhtml-bypassed-when-a-disallowed-tag-name-cea607bc)
- [league/commonmark polynomial time complexity denial of service](https://junglewise.ai/threats/cve-2024-58382-league-commonmark-polynomial-time-complexity-denial-of-service)
- [league/commonmark AttributesExtension XSS bypass with U+000C](https://junglewise.ai/threats/cve-2026-86431-league-commonmark-attributesextension-xss-bypass-with-u-000c)
- [league/commonmark denial of service in parsing](https://junglewise.ai/threats/cve-2026-86430-league-commonmark-denial-of-service-in-parsing)
- [League CommonMark quadratic parsing complexity denial of service](https://junglewise.ai/threats/cve-2026-86429-league-commonmark-quadratic-parsing-complexity-denial-of-service)