Description

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-07T13:20:43.013Z",
  "pubdate": "2026-09-07T13:20:43.013Z",
  "executiveSummary": "The Footnote extension within the commonmark library, specifically versions 1.5.0 through 2.8.3, is susceptible to a Denial of Service (DoS) vulnerability arising from improper handling of duplicate footnote definitions. This security flaw allows an attacker to manipulate the document parsing process, forcing the application to perform redundant operations that result in quadratic output expansion. By crafting malicious input containing multiple identical footnote definitions and corresponding references, an attacker can trigger excessive memory consumption and CPU saturation, effectively exhausting server resources. This vulnerability poses a significant risk to the availability of systems leveraging the commonmark library for document processing, as it permits unauthorized users to crash or severely degrade the performance of the host service without requiring special privileges or authentication. The impact is primarily a loss of service availability, potentially affecting any application that permits user-provided input to be rendered via the vulnerable Footnote extension.",
  "technicalDetails": "The vulnerability resides within the logic used by the commonmark Footnote extension to process and map document-level footnotes. The root cause is the library's failure to implement an adequate deduplication mechanism when encountering multiple footnote definitions that share the same identifier within a single document context.\nDuring the parsing phase, the Footnote extension attempts to resolve footnote references to their respective content definitions. When a document is crafted to include a high volume of duplicate footnote definitions, the parser fails to consolidate these instances. Instead of identifying the first instance and disregarding subsequent definitions, the implementation continues to process each duplicate entry. This creates a computational complexity issue characterized by quadratic output expansion; the effort required to resolve the footnotes grows exponentially relative to the number of defined duplicates.\nThe attack flow proceeds as follows: 1) An attacker submits a maliciously crafted Markdown document containing a structural pattern of repetitive footnote definitions (e.g., [^1]: content followed by multiple additional [^1]: definitions). 2) The parser invokes the Footnote extension to reconcile these definitions. 3) The extension attempts to allocate resources and execute lookups for every duplicate definition encountered. 4) The quadratic processing time and increased memory footprint force the server to allocate excessive heap memory to track these redundant structures. 5) As the parser struggles to manage the overhead, it exhausts CPU cycles and memory limits. 6) The host process either experiences significant latency, triggering performance degradation, or terminates due to out-of-memory errors (OOM).\nThis vulnerability is inherent to the parsing logic of the Footnote extension and does not require elevated privileges or authentication, making it particularly dangerous in web applications that accept and render user-generated Markdown content. The exposure is limited to applications that have explicitly enabled the Footnote extension within their commonmark configuration. The exploitation does not require advanced post-exploitation techniques, as the primary impact is the immediate denial of service upon document submission and rendering."
}