https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T08:26:36.640880+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-372627 EUVD-2026-372627 2026-10-04T08:26:36.643899+00:00 EUVD-2026-372627 https://cve.radiocsirt.org/vuln/fkie_cve-2026-86434 fkie_cve-2026-86434 2026-10-04T08:26:36.643930+00:00

league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.

 https://cve.radiocsirt.org/vuln/ghsa-jcmh-chhq-rh2x GHSA-jcmh-chhq-rh2x 2026-10-04T08:26:36.643964+00:00

league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-86434 UBUNTU-CVE-2026-86434 2026-10-04T08:26:36.643984+00:00

Affected: Ubuntu:Pro:20.04:LTS: php-league-commonmark, Ubuntu:Pro:22.04:LTS: php-league-commonmark, Ubuntu:Pro:24.04:LTS: php-league-commonmark, Ubuntu:26.04:LTS: php-league-commonmark

league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.