Description

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service. Fixed in 2.9.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-07T13:20:42.180Z",
  "pubdate": "2026-09-07T13:20:42.180Z",
  "executiveSummary": "The league/commonmark library is susceptible to a Denial of Service (DoS) vulnerability due to quadratic parsing complexity within its optional extensions. The flaw exists in the SmartPunctExtension and AttributesExtension components when they are explicitly enabled in the configuration.\nBy submitting small, specifically crafted Markdown payloads—such as sequences of unpaired quotes, contiguous block-level attribute blocks, or repetitive class attributes—an unauthenticated attacker can force the parser to perform a disproportionate number of operations relative to the input size.\nThis behavior leads to excessive CPU resource consumption, potentially exhausting server-side processing capabilities and rendering the application unavailable. The vulnerability does not require authentication to exploit, though it is limited to environments where the specific vulnerable extensions have been manually registered, as they are not enabled by default in standard configurations.\nOrganizations using affected versions of thephpleague/commonmark (>= 1.5.0 and < 2.9.1) should prioritize updating to version 2.9.1 or higher to mitigate this risk.",
  "technicalDetails": "The vulnerability resides in the parsing logic of the SmartPunctExtension and AttributesExtension within the league/commonmark library. The root cause is a quadratic time complexity ($O(n^2)$) inherent in the algorithm used to process these specific Markdown constructs. When the parser encounters malformed or deeply nested patterns associated with smart punctuation or attribute syntax, the computational cost grows quadratically as the input document grows, rather than linearly.\nThe SmartPunctExtension is responsible for handling features like smart quotes and ellipses. The vulnerability manifests when the parser attempts to resolve unmatched or highly frequent punctuation markers, leading to an iterative state-tracking overhead that consumes significant CPU cycles. Similarly, the AttributesExtension, which allows users to define custom attributes (e.g., classes or IDs) on Markdown elements, exhibits this vulnerability when presented with contiguous runs of attribute blocks or repeatedly nested class attributes. These patterns force the parser into an inefficient backtracking or multi-pass processing cycle to resolve element associations.\nThe attack flow follows a straightforward pattern: 1) An attacker identifies an application that utilizes league/commonmark with either the SmartPunctExtension or AttributesExtension enabled. 2) The attacker crafts a small but malicious Markdown payload specifically designed to trigger the identified algorithmic complexity in the parser, such as a string containing hundreds of alternating unpaired quotes or a sequence of concatenated attribute blocks. 3) The payload is submitted to the application's Markdown processing endpoint. 4) Upon parsing, the engine enters a high-CPU state attempting to reconcile the complex/malformed input, effectively blocking the processing thread.\nBecause the parsing process is single-threaded in standard PHP environments, prolonged CPU exhaustion on the parsing task prevents the application from responding to legitimate requests, resulting in a Denial of Service. The impact is primarily local to the server process handling the request; however, in environments with concurrent users, a small number of these requests can saturate the available CPU resources, leading to global application unavailability.\nThis vulnerability is version-dependent, specifically affecting versions 1.5.0 through 2.9.0. It is critical to note that the vulnerability is conditional: only instances where the `Environment` is explicitly configured to include these two extensions are at risk. Standard implementations using the default CommonMark or GitHub-Flavored Markdown (GFM) presets remain unaffected unless the extensions are manually added."
}