CVE-2026-71488: 
PHP vulnerability analysis and mitigation

CVE-2026-71488 is a quadratic-time denial-of-service vulnerability in league/commonmark, a widely used PHP library for parsing and rendering CommonMark Markdown. Affecting versions from 0.6.0 through 2.8.3, the flaw allows an unauthenticated remote attacker to submit specially crafted Markdown input that causes the parser to perform O(n²) work, consuming disproportionate CPU time with a comparatively small request. The vulnerability was disclosed on August 6, 2026, and is fixed in version 2.9.0. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is inefficient algorithmic complexity (CWE-407, CWE-1050) arising from two distinct parsing paths. First, the Cursor class internally tracks positions using character indices, but PHP's preg_match and related functions return byte offsets; on multibyte (UTF-8) lines, the parser repeatedly called mb_substr() from the start of the line to translate between the two coordinate systems, making each translation O(position) and the full scan O(n²). Second, the UrlAutolinkParser (used by AutolinkExtension and GithubFlavoredMarkdownExtension) copied and re-validated the entire remaining line suffix at every URL-like prefix (e.g., www., https://), also yielding quadratic behavior. A single non-ASCII character anywhere on a line places it on the slower multibyte path; combining it with a long run of leading whitespace, repeated Markdown punctuation, or repeated URL-like prefixes is sufficient to trigger the worst case — all within a single long line, requiring no complex Markdown structure. The fix in 2.9.0 introduces a lazily-built character-to-byte offset map (checkpoint interval of 16) in Cursor, rewrites Cursor::match() to match against the persistent line at the current byte offset instead of copying the remainder, and anchors the autolink regex against the original line at the current byte position (GitHub Advisory, Patch Commit).

Successful exploitation causes a denial-of-service condition limited to availability — there is no data disclosure, integrity impact, or bypass of rendering restrictions such as html_input or allow_unsafe_links. An attacker who can submit Markdown for conversion (e.g., via a comment form, wiki editor, or API endpoint) can send a comparatively small request that consumes all available CPU time; repeated or concurrent requests can exhaust all PHP worker processes and prevent legitimate requests from completing. The core multibyte paths affect CommonMarkConverter, GithubFlavoredMarkdownConverter, and any custom environments, while the autolink-specific path additionally affects applications using AutolinkExtension or GithubFlavoredMarkdownExtension. Applications that process only trusted Markdown are not remotely exploitable (GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, exploitation requires no authentication, no user interaction, and low attack complexity — an attacker only needs the ability to submit Markdown input to a vulnerable endpoint. The vulnerability is network-accessible and the trigger fits within a single crafted line, making it straightforward to weaponize against any publicly exposed Markdown conversion service (GitHub Advisory, Feedly).

1. Identify a target: Locate a web application or API endpoint that accepts user-supplied Markdown and converts it using league/commonmark versions 0.6.0–2.8.3 (e.g., comment boxes, wiki editors, documentation platforms, or REST APIs accepting Markdown bodies).
2. Craft a multibyte trigger line (core path): Construct a single long line containing one non-ASCII UTF-8 character (e.g., é) followed by a large number of repeated Markdown punctuation characters or leading spaces — for example, é + 300,000 spaces, or é + 100,000 repetitions of a_. This forces the parser onto the slow multibyte path and triggers quadratic rescanning.
3. Craft an autolink trigger line (autolink path): If the target uses AutolinkExtension or GithubFlavoredMarkdownExtension, construct a line with a non-ASCII prefix followed by a large number of repeated invalid URL-like prefixes — for example, é + 160,000 repetitions of www. . Each prefix causes the parser to copy and validate the entire remaining line suffix.
4. Submit the payload: Send the crafted Markdown as an HTTP request to the target endpoint. A single request with a sufficiently long trigger line can saturate a PHP worker for an extended period.
5. Amplify with concurrent requests: Send multiple concurrent requests to exhaust all available PHP-FPM or web server worker processes, causing legitimate requests to time out or be rejected, achieving a sustained denial-of-service condition (GitHub Advisory, Patch Commit).

• Network: Unusual HTTP requests containing very long single-line Markdown payloads (hundreds of thousands of characters on one line) submitted to Markdown-processing endpoints; elevated request rates to Markdown conversion APIs from a single source IP.
• Logs: Web server or application logs showing requests with abnormally large body sizes concentrated in a single line; PHP-FPM or web server logs showing worker processes timing out or being killed during Markdown conversion operations; repeated slow or failed responses from Markdown rendering endpoints.
• Process: PHP worker processes (e.g., php-fpm) consuming 100% CPU for extended periods without completing; system load spikes correlated with incoming requests to Markdown-processing routes; PHP execution time limit errors (Maximum execution time exceeded) in application error logs.

The primary remediation is to upgrade league/commonmark to version 2.9.0 or later, which fixes the quadratic complexity in all affected parsing paths. Users on the unsupported 0.x or 1.x release lines must upgrade to 2.9.0 or later, as no backports are planned. If immediate upgrade is not possible, the advisory recommends: (1) rejecting or truncating inputs with excessively long individual lines before passing them to the converter, since every demonstrated trigger fits on a single line; (2) applying a total request-size limit in addition to a per-line limit; (3) restricting Markdown conversion to trusted users; (4) enforcing strict PHP execution-time limits; (5) rate-limiting and limiting concurrent conversions. Disabling AutolinkExtension and avoiding GithubFlavoredMarkdownExtension removes the autolink-specific trigger but does not eliminate the core multibyte parsing vulnerability (GitHub Advisory, Release 2.9.0).

The vulnerability was responsibly disclosed by GrahamCampbell, who is credited in the official advisory and the 2.9.0 release notes. The 2.9.0 release addressed a total of six security issues (five DoS and one XSS), making it a significant security release for the library. No notable broader media coverage or social media discussion beyond the GitHub advisory and standard vulnerability feed aggregation has been identified at this time (Release 2.9.0, GitHub Advisory).