CVE-2026-105830

Summary

A quadratic-time denial of service vulnerability exists in league/commonmark's GitHub Flavored Markdown Table extension where processing large paragraphs without pipe characters can cause excessive CPU usage through repeated string scans, potentially leading to service unavailability.

Exploitability

Exploitation is straightforward for unauthenticated attackers who can submit specially crafted markdown content that triggers repeated full-buffer strpos scans, requiring no additional authentication or complex setup.

Blast radius

The vulnerability could impact web applications using this library for markdown processing, potentially causing widespread service disruption when attackers submit malicious markdown content to endpoints that process user input.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.10.2 or later to remediate the quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.