[GHSA] GHSA-2q4p-g7hv-5rgv (high) — league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

GHSA-2q4p-g7hv-5rgv Severity: high CVE: CVE-2026-71488

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

### Impact

Affected versions of `league/commonmark` can have quadratic time complexity when parsing specially crafted Markdown lines. In practical terms, doubling the length of an affected line can make the parser perform roughly four times as much work. The p