Description

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-07T13:20:42.320Z",
  "pubdate": "2026-09-07T13:20:42.320Z",
  "executiveSummary": "The league/commonmark library is susceptible to multiple Denial of Service (DoS) vulnerabilities arising from inefficient algorithmic complexity during the parsing of specific Markdown constructs. These vulnerabilities exist within the fenced code block detection, reference link label lookup, and emphasis delimiter processing mechanisms.\nBy submitting crafted Markdown payloads, an unauthenticated remote attacker can trigger super-linear computational work, leading to excessive CPU consumption. This resource exhaustion effectively denies service to legitimate users by blocking the application thread responsible for parsing. Affected versions include all releases prior to 2.9.1.\nThe risk is primarily availability-related, where the application becomes unresponsive or crashes under load. No specialized privileges or authentication are required to trigger these vulnerabilities, as the exploit vector is the standard Markdown processing pipeline. Organizations utilizing affected versions are at risk of service disruption if the library processes untrusted user-supplied input.",
  "technicalDetails": "The vulnerability stems from the implementation of core parsing logic in league/commonmark, specifically where the regular expression matching or iterative search algorithms exhibit super-linear time complexity relative to the size of the input. This algorithmic inefficiency is triggered when the parser encounters specific, deeply nested or highly repetitive Markdown patterns.\nIn the context of fenced code block detection, the parser fails to properly terminate or optimize searches for closing delimiters when long runs of backticks are provided in a crafted sequence. Similarly, the reference link label lookup mechanism lacks adequate bounds or shortcuts when parsing deeply nested bracket structures, causing the lookup algorithm to re-evaluate the same input segments recursively or repeatedly.\nEmphasis delimiter processing is also flawed, where the handling of overlapping or redundant delimiter sequences leads to a combinatorial explosion of states. The parser attempts to resolve these delimiters without maintaining sufficient state to prevent redundant processing cycles, leading to high CPU usage.\nThe attack flow follows a predictable pattern: 1) An attacker identifies an application endpoint that renders Markdown input from an untrusted source. 2) The attacker submits a malicious payload consisting of highly repetitive, nested, or structurally complex Markdown patterns (e.g., thousands of nested brackets or excessive backticks). 3) The league/commonmark parser attempts to normalize and convert this input to HTML. 4) The complexity of the chosen parsing algorithm results in O(n^k) or exponential time complexity, monopolizing CPU resources. 5) As the parser stalls on a single request, the application thread pool is exhausted, leading to a complete Denial of Service for all concurrent users.\nThis vulnerability is inherent to the library's internal state machine logic. Because it does not require interaction with underlying system files or databases, the exploit is restricted to the CPU-bound processing layer. The vulnerability affects all versions of league/commonmark prior to 2.9.1, as the internal parsing heuristics were insufficiently constrained in earlier releases."
}