Description

league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-07T13:20:42.870Z",
  "pubdate": "2026-09-07T13:20:42.870Z",
  "executiveSummary": "The library league/commonmark, specifically versions ranging from 2.0.0 to 2.8.4, contains an algorithmic complexity vulnerability located in the UniqueSlugNormalizer::normalize() function. This flaw allows an unauthenticated attacker to trigger a Denial of Service (DoS) condition by submitting maliciously crafted Markdown payloads.\nThe vulnerability manifests when specific extensions—namely HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension—are enabled. By exploiting the inefficient numeric-suffix incrementation logic, an attacker can force the application into an O(K^2) computational state when processing multiple headings that normalize to the same base slug.\nThe impact is significant, as the resulting CPU exhaustion can cause application unresponsiveness or complete service degradation. Exploitation requires no prior authentication or elevated privileges, making it a viable vector for remote attackers capable of submitting Markdown content to the target system. The vulnerability is effectively addressed in version 2.9.0, which optimizes the slug generation process.",
  "technicalDetails": "The vulnerability resides within the UniqueSlugNormalizer::normalize() method of league/commonmark. This component is responsible for generating unique identifiers for Markdown elements like headings, footnotes, and table-of-contents entries to ensure HTML anchors remain valid and non-colliding. The root cause of the vulnerability is an inefficient collision resolution algorithm.\nWhen a slug collision occurs (i.e., multiple elements share the same base slug string), the normalizer attempts to resolve the conflict by appending a numeric suffix. In the vulnerable versions, the implementation restarts the search for a unique numeric suffix beginning from 1 every time a collision is detected. This logic creates a performance bottleneck: as the number of elements (K) that collapse to the same base slug increases, the number of required checks grows quadratically.\nSpecifically, for the first element, the algorithm performs a single lookup. For the second element, it may check the base slug and the slug with suffix '-1'. For the K-th element, it potentially iterates through all previous suffixes to find an available increment. This results in O(K^2) time complexity, where K is the number of colliding headings. An attacker can easily trigger this behavior by providing a payload containing numerous headings that normalize to the same slug (e.g., repeating punctuation-only strings, identical text, or empty ATX headings).\nThe vulnerable path is activated when the user registers HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension. These extensions rely heavily on the slug normalizer. The attack flow involves the following steps: 1) The attacker submits a Markdown document containing a high density of structurally identical headers. 2) The parser invokes the normalizer for each header, triggering the nested loop collision resolution mechanism. 3) The CPU utilization of the PHP process spikes significantly as the search cycles increase for every subsequent heading. 4) By submitting a sufficiently large number of such headings, the attacker forces the server into a state of CPU starvation, effectively denying service to legitimate users.\nThis vulnerability does not require authentication or specific privilege levels, as it is a direct result of parsing user-supplied input. The exposure is limited to applications that expose Markdown processing endpoints where the aforementioned extensions are enabled and configured to process untrusted input."
}