Description

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming disproportionate CPU resources and preventing legitimate requests from completing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-07T13:20:42.037Z",
  "pubdate": "2026-09-07T13:20:42.037Z",
  "executiveSummary": "The commonmark library, specifically within versions 1.5.0 through 2.0.9, contains a critical Denial of Service (DoS) vulnerability located in the AttributesExtension component.\nThe vulnerability stems from algorithmic complexity issues during the attribute merging and filtering process.\nBy crafting specific Markdown payloads containing a high volume of distinctly-named attributes, an unauthenticated attacker can force the application into a quadratic-time execution state.\nThis behavior results in the exhaustion of CPU resources, effectively preventing the system from processing legitimate requests and leading to service unavailability.\nThe impact is categorized as a resource exhaustion attack, which can be triggered remotely without specific privileges, provided the application processes untrusted Markdown input through the affected extension.\nOrganizations relying on these versions are at risk of system instability when handling user-supplied content.",
  "technicalDetails": "The vulnerability resides within the AttributesExtension of the commonmark library, which is designed to parse and apply custom attributes to Markdown elements. The root cause of this vulnerability is an inefficient implementation of the attribute merging and filtering logic when handling a large number of distinct attribute names within a single document.\nWhen the AttributesExtension encounters multiple distinct attribute definitions, it performs iterative merge and filter operations. Due to the underlying data structure and the logic employed to process these attributes, the operation exhibits O(n^2) or quadratic time complexity. As the number of unique attribute identifiers increases in the payload, the CPU cycles required to resolve these attributes grow exponentially rather than linearly.\nThe attack flow begins when an attacker submits a specially crafted Markdown string to an application utilizing the vulnerable version of the commonmark library. This string contains an extensive sequence of unique, distinct attribute declarations. Upon ingestion, the parser triggers the AttributesExtension, which initiates the recursive or iterative attribute resolution process.\nBecause the logic fails to bound the complexity of this resolution, the CPU becomes fully saturated attempting to merge these distinct attribute sets. This leads to thread or process hanging, preventing the application from serving other requests. Because the processing time is directly proportional to the number of distinct attributes provided, the attacker can effectively force the application to drop incoming traffic, resulting in a denial-of-service state.\nThe vulnerability is present in versions 1.5.0 through 2.0.9, as the problematic implementation of the attribute processing logic remained unchanged across these releases. Exploitation does not require authentication or elevated privileges, provided the attacker can submit Markdown content that is subsequently processed by the server. The impact is strictly limited to availability; no remote code execution or data exfiltration is achieved through this vector. However, the ease of triggerability—requiring only a payload of distinct attribute names—makes this a significant risk for any service exposing Markdown parsing functionality to external, untrusted users."
}