| Bug | bookworm | trixie | forky | sid | Description |
|---|
| TEMP-0000000-2BB8EF | vulnerable | vulnerable | fixed | fixed | GHSA-3q6v-r5mr-hxv8: Fix quadratic-time table start detection on long paragraphs |
| TEMP-0000000-00E231 | vulnerable | vulnerable | fixed | fixed | GHSA-97jj-33gv-5xf9: Escape disallowed raw HTML tags that end the rendered output |
| CVE-2026-86435 | vulnerable | vulnerable | fixed | fixed | commonmark versions from 1.5.0 before 2.8.4 contain a denial of servic ... |
| CVE-2026-86434 | vulnerable | vulnerable | fixed | fixed | league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) con ... |
| CVE-2026-86433 | vulnerable | vulnerable | fixed | fixed | commonmark versions from 1.5.0 before 2.8.4 contain a denial of servic ... |
| CVE-2026-86432 | vulnerable | vulnerable | fixed | fixed | commonmark versions from 2.0.0 before 2.8.4 contain a denial of servic ... |
| CVE-2026-86431 | vulnerable | vulnerable | fixed | fixed | league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2. ... |
| CVE-2026-86430 | vulnerable | vulnerable | fixed | fixed | league/commonmark versions before 2.9.1 contain multiple denial of ser ... |
| CVE-2026-86429 | vulnerable | vulnerable | fixed | fixed | The league/commonmark (thephpleague/commonmark) library in versions >= ... |
| CVE-2026-86428 | vulnerable | vulnerable | fixed | fixed | commonmark versions from 1.5.0 before 2.10.0 contain a denial of servi ... |
| CVE-2026-71488 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | league/commonmark is a PHP library for parsing and rendering CommonMar ... |
| CVE-2026-71478 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | league/commonmark is a PHP library for parsing and rendering CommonMar ... |
| CVE-2024-58382 | vulnerable (no DSA, postponed) | fixed | fixed | fixed | league/commonmark versions before 2.6.0 contain polynomial time comple ... |