Description

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T22:18:31.893Z",
  "pubdate": "2026-08-06T22:18:31.893Z",
  "executiveSummary": "An algorithmic complexity vulnerability exists in the league/commonmark PHP library affecting versions from 0.6.0 until 2.9.0. The vulnerability manifests as a quadratic time complexity parsing issue when processing specially crafted Markdown lines. An attacker capable of submitting arbitrary Markdown for conversion can exploit this behavior by providing inputs designed to trigger excessive CPU consumption, resulting in a denial of service (DoS) condition. The risk implication is significant for applications parsing untrusted user input, as disproportionate computational resources are consumed relative to the small size of the incoming request. No specific authentication or high-level privileges are required beyond the ability to submit data for parsing. Remediation requires upgrading the library to version 2.9.0 where the underlying translation between character and byte positions and the Autolink extension handling have been corrected.",
  "technicalDetails": "The vulnerability resides within the parsing and rendering engine of the league/commonmark library, specifically impacting versions 0.6.0 through 2.9.0. The root cause of the quadratic time complexity ($O(n^2)$) stems from inefficient translation mechanisms between character positions and byte positions. Several internal parsing paths repeatedly rescan growing portions of a single Markdown line during processing. Additionally, the Autolink extension exacerbates this computational bottleneck by copying and validating the remaining portion of the line at every encountered URL-like prefix.\nExploitation occurs when an attacker submits a specially crafted Markdown payload containing specific character sequences or repeated URL-like prefixes. Step-by-step, the attack flow proceeds as follows: First, the application passes the untrusted Markdown input to the league/commonmark parser. Second, as the parser encounters the malicious line structures, internal routines repeatedly iterate over expanding segments to compute character-to-byte offsets. Third, the Autolink extension repeatedly evaluates remaining substrings at scale. Fourth, this redundant rescanning and validation forces the CPU utilization to spike dramatically, consuming excessive processing cycles for a comparatively diminutive payload.\nThe vulnerable components include the core parsing routines responsible for character-to-byte position translation and the Autolink extension. The vulnerability can be triggered via network exposure in any web application or service that accepts and renders user-supplied Markdown input without prior validation or rate limiting. Exploitation does not require authentication or elevated privileges, relying solely on the application's exposure of a Markdown parsing interface."
}