league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0,
    specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting,
    because several parsing paths repeatedly rescan growing portions of a line to translate between character
    positions and byte positions, and the Autolink extension can also copy and validate the remaining line at
    every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume
    disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.
    (CVE-2026-71488)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0,     specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting,     because several parsing paths repeatedly rescan growing portions of a line to translate between character     positions and byte positions, and the Autolink extension can also copy and validate the remaining line at     every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume     disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.
    (CVE-2026-71488)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
445775	SCA: security update for league/commonmark (GHSA-2q4p-g7hv-5rgv)	Tenable Cloud Security	SCA Checks	Local	high
445775	SCA: security update for league/commonmark (GHSA-2q4p-g7hv-5rgv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
333359	Linux Distros Unpatched Vulnerability : CVE-2026-71488	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-71488

high

Tenable Plugins

high

high

high