PatchTheCVECVE-2026-71488: league/commonmark is a PHP library for parsing and rendering CommonMark Markdown
CVE-2026-71488 is a high-severity flaw (CVSS 7.5) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allo
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-71488?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-71488 being exploited?
CVE-2026-71488 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-71488 affect?
CVE-2026-71488 affects affected software. Severity is high (CVSS 7.5). league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths
How urgent is CVE-2026-71488?
Priority 44/100. High severity; Remotely exploitable, no login, no user action