Logo
Retour à la veille

CVE-2026-71488

Publié : 6 août 2026
Modifié : 6 août 2026
Lien officiel NVD
Score CVSS
7.5
HIGH

Description détaillée

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Références et Patchs

https://github.com/thephpleague/commonmark/commit/a6ef6cdc308dfa39a34239c35818e75892a0e6a8https://github.com/thephpleague/commonmark/commit/a70979ea0d7d3377bd7127536748454a922bf5ebhttps://github.com/thephpleague/commonmark/commit/c97b02e5e652b992033b93ba5d6182f706343fc6https://github.com/thephpleague/commonmark/releases/tag/2.9.0https://github.com/thephpleague/commonmark/security/advisories/GHSA-2q4p-g7hv-5rgv

Dernières Vulnérabilités

CVE-2026-70332

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

VOIR DÉTAILS

CVE-2026-68823

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.

VOIR DÉTAILS

CVE-2026-65668

Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.

VOIR DÉTAILS