{"action":"Upgrade league/commonmark to 2.9.0 or later.","affected":[{"fixed":"2.9.0","introduced":"0.6.0"}],"component":"league/commonmark","cve_ids":["CVE-2026-71488"],"ecosystem":"Packagist","epss":0.0063,"exploited":false,"fixed_versions":["2.9.0"],"ghsa_id":"GHSA-2q4p-g7hv-5rgv","id":"tcs_01M5KES5SBNZDSZVWEQSFQ36H0","modified_at":"2026-08-21T05:21:14.106549823Z","published_at":"2026-08-06T20:37:20Z","references":["https://osv.dev/vulnerability/GHSA-2q4p-g7hv-5rgv","https://github.com/thephpleague/commonmark/security/advisories/GHSA-2q4p-g7hv-5rgv","https://github.com/thephpleague/commonmark/commit/a6ef6cdc308dfa39a34239c35818e75892a0e6a8","https://github.com/thephpleague/commonmark/commit/a70979ea0d7d3377bd7127536748454a922bf5eb","https://github.com/thephpleague/commonmark/commit/c97b02e5e652b992033b93ba5d6182f706343fc6","https://github.com/thephpleague/commonmark","https://github.com/thephpleague/commonmark/releases/tag/2.9.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-2q4p-g7hv-5rgv","url":"https://osv.dev/vulnerability/GHSA-2q4p-g7hv-5rgv"}],"summary":"league/commonmark: Quadratic-time denial of service when parsing crafted Markdown"}