Thephpleague vulnerabilities
We track 11 vulnerabilities in Thephpleague products across 2 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on October 8, 2026.
Latest Thephpleague vulnerabilities
- 7.5 High severity
commonmark: Uncontrolled Resource Consumption
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe
- 7.5 High severity
commonmark: Inefficient Algorithmic Complexity
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, a
- 7.5 High severity
commonmark: Inefficient Algorithmic Complexity
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic
- 7.5 High severity
commonmark: Inefficient Algorithmic Complexity
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for
- 7.5 High severity
commonmark: Inefficient Algorithmic Complexity
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximate
- 7.2 High severity
commonmark: Improper Neutralization of Input During Web Page Generation
league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte (e.g. {\x0Conclick="alert(1)"}) bypasses the Attr
- 7.5 High severity
commonmark: Inefficient Algorithmic Complexity
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit spec
- 7.5 High severity
commonmark: Inefficient Algorithmic Complexity
The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not e
- 7.5 High severity
commonmark: Inefficient Algorithmic Complexity
commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribut
- 7.5 High severity
commonmark: Inefficient Algorithmic Complexity
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan g
- 7.5 High severity
oauth2-server: Generation of Error Message Containing Sensitive Information
league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had th