Description

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-07T13:20:42.733Z",
  "pubdate": "2026-09-07T13:20:42.733Z",
  "executiveSummary": "The Attributes extension in commonmark, versions 1.5.0 through 2.8.3, is susceptible to a Denial of Service (DoS) vulnerability originating from inefficient algorithmic complexity during document parsing. The flaw resides in the AttributesListener::findTargetAndDirection() function, which implements a quadratic-time traversal mechanism when scanning sibling lists.\nUnauthenticated remote attackers can exploit this vulnerability by submitting specially crafted Markdown input containing repeated attribute blocks. By providing approximately 32 KB of nested or sequential attribute structures, an attacker can force the parser to perform an excessive number of operations, leading to prolonged CPU utilization exceeding 5 seconds per request.\nThis resource exhaustion scenario poses a significant risk to availability, as an attacker can monopolize server threads, effectively causing a DoS for legitimate users. Successful exploitation requires no authentication or special privileges, as the vulnerability is triggered through standard document processing workflows. Given the prevalence of commonmark in various rendering engines, the impact extends to any application utilizing the affected Attributes extension versions to process untrusted user-supplied Markdown content.",
  "technicalDetails": "The root cause of the vulnerability is an algorithmic inefficiency within the Attributes extension for commonmark. Specifically, the function AttributesListener::findTargetAndDirection() is designed to resolve attribute targets by traversing the document's sibling list structure. The implementation utilizes a linear scan that exhibits O(n^2) time complexity relative to the number of attribute blocks present in a given scope.\nThe exploitation flow begins when an attacker crafts a malicious payload consisting of a dense sequence of attributes. When the parser encounters these blocks, the AttributesListener invokes findTargetAndDirection() to associate the attributes with their respective targets. Because the algorithm performs a nested lookup process across the list of sibling nodes for every attribute block processed, the workload grows quadratically rather than linearly.\nA payload size of approximately 32 KB is sufficient to force the parser into a worst-case execution path, consuming CPU cycles for an extended duration (e.g., > 5 seconds). Since the parsing process is typically synchronous and blocking within the host application, this sustained computational demand prevents the server from processing concurrent requests, leading to thread exhaustion and service degradation.\nThe vulnerable component is identified as the Attributes extension module of the commonmark package. The issue affects all versions from 1.5.0 up to, but not including, 2.8.4. Because the vulnerability is triggered at the parsing layer, it is reachable via any interface that accepts Markdown input from external actors, including web forms, API endpoints, and document upload features. No authentication is required to initiate the attack, and the payload does not need to satisfy complex structural requirements beyond the repetition of attribute blocks to trigger the performance degradation.\nThere are no requirements for elevated privileges or interaction beyond the submission of the document. The post-exploitation impact is strictly centered on availability; the vulnerability does not inherently facilitate arbitrary code execution or unauthorized data access. However, the resulting DoS condition remains a critical concern for infrastructure reliability, particularly in environments with high-traffic exposure or limited resource isolation for the Markdown parsing engine."
}