{"items":[{"id":"NVI-00001917","kind":"vulnerability","title":"league/commonmark: Denial of service in the SmartPunct and Attributes extensions","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-jjv6-8j6v-6j52","CVE-2026-86429"],"plain_summary":"OSV carries this publisher advisory for league/commonmark. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.9.1 for league/commonmark. Confirm the publisher’s latest guidance.","source_ids":["sr-0508550f32d36a66a2d2c2927e5ba131"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-8a456efe0d4d6caa02dde9907d6e9b66"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-08T16:17:57.003Z","value":"7.5 HIGH (3.1)","meaning":"disclosure@vulncheck.com severity; no combined Null risk score.","source_id":"sr-8a456efe0d4d6caa02dde9907d6e9b66"},{"kind":"CVSS","as_of":"2026-10-08T16:17:57.003Z","value":"8.7 HIGH (4.0)","meaning":"disclosure@vulncheck.com severity; no combined Null risk score.","source_id":"sr-8a456efe0d4d6caa02dde9907d6e9b66"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0508550f32d36a66a2d2c2927e5ba131","url":"https://github.com/advisories/GHSA-jjv6-8j6v-6j52","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-jjv6-8j6v-6j52","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.966Z"},{"id":"sr-8a456efe0d4d6caa02dde9907d6e9b66","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86429","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-86429","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T07:25:08.112Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0508550f32d36a66a2d2c2927e5ba131"],"technology":"league/commonmark","known_exclusions":[],"conditions_summary":"### Impact\n\nTwo first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitly registered on the `Environment`; neither is included in `CommonMarkConverter`, `GithubFlavoredMarkdownConverter`, or `GithubFlavoredMarkdownExtension`. **Applications that do not register `SmartPunctExtension` or `AttributesExtension` are not affected by this advisory.**\n\n**1. `SmartPunctExtension` — quote replacement recopies the whole text node (affected from 2.0.0).**\n\n`ReplaceUnpairedQuotesListener` converts each unpaired `Quote` node back to a `Text` node and merges it into its neighbours via `AdjacentTextMerger`. The merge reads the left node's literal into a local variable, appends to that variable, and writes it back — and because the read aliases the node's string, every append copies the entire accumulated literal rather than only the bytes added. The listener runs this once per surviving unpaired quote against the same continuously growing text node, so the same buffer is fully re-copied a linear number of times.\n\nA 1.2 MB document of alternating text segments and apostrophes takes 34.9 seconds to convert, against 0.069 seconds for the same input with","public_affected_ranges":["ECOSYSTEM: introduced 1.5.0; fixed 2.9.1"]}],"null_published_at":"2026-11-03T17:49:21.363Z","source_updated_at":"2026-09-08T12:38:13.841Z","source_disclosed_at":"2026-09-01T20:21:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:30.966Z"},{"id":"NVI-00001917","kind":"vulnerability","title":"league/commonmark: Denial of service in the SmartPunct and Attributes extensions","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jjv6-8j6v-6j52","CVE-2026-86429"],"plain_summary":"OSV carries this publisher advisory for league/commonmark. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.9.1 for league/commonmark. Confirm the publisher’s latest guidance.","source_ids":["sr-0508550f32d36a66a2d2c2927e5ba131"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0508550f32d36a66a2d2c2927e5ba131","url":"https://github.com/advisories/GHSA-jjv6-8j6v-6j52","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-jjv6-8j6v-6j52","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.966Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0508550f32d36a66a2d2c2927e5ba131"],"technology":"league/commonmark","known_exclusions":[],"conditions_summary":"### Impact\n\nTwo first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitly registered on the `Environment`; neither is included in `CommonMarkConverter`, `GithubFlavoredMarkdownConverter`, or `GithubFlavoredMarkdownExtension`. **Applications that do not register `SmartPunctExtension` or `AttributesExtension` are not affected by this advisory.**\n\n**1. `SmartPunctExtension` — quote replacement recopies the whole text node (affected from 2.0.0).**\n\n`ReplaceUnpairedQuotesListener` converts each unpaired `Quote` node back to a `Text` node and merges it into its neighbours via `AdjacentTextMerger`. The merge reads the left node's literal into a local variable, appends to that variable, and writes it back — and because the read aliases the node's string, every append copies the entire accumulated literal rather than only the bytes added. The listener runs this once per surviving unpaired quote against the same continuously growing text node, so the same buffer is fully re-copied a linear number of times.\n\nA 1.2 MB document of alternating text segments and apostrophes takes 34.9 seconds to convert, against 0.069 seconds for the same input with","public_affected_ranges":["ECOSYSTEM: introduced 1.5.0; fixed 2.9.1"]}],"null_published_at":"2026-10-31T21:53:28.058Z","source_updated_at":"2026-09-08T12:38:13.841Z","source_disclosed_at":"2026-09-01T20:21:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:30.966Z"}],"next_cursor":null,"snapshot_revision":"42594"}