Executive brief
league/commonmark is a PHP library that parses Markdown text, widely used in web applications. Versions before 2.6.0 contain algorithmic inefficiencies that allow attackers to submit malicious Markdown inputs that consume excessive CPU resources. An attacker can exhaust server processing capacity and crash PHP services by sending multiple crafted requests in parallel, making the application unavailable to legitimate users.
Technical details
This vulnerability is a polynomial time complexity issue (CWE-407) in the Markdown parsing algorithm used by league/commonmark. The root cause stems from inefficient pattern matching and parsing logic that reaches worst-case O(n²) or higher complexity when processing specially crafted Markdown inputs. The attack vector is network-based with no authentication or user interaction required—an attacker simply submits malicious Markdown strings via any application feature that uses this library. By sending multiple requests in parallel, an attacker can exhaust CPU resources and PHP-FPM worker processes, resulting in denial of service. The vulnerability has been patched in version 2.6.0; users on older versions should upgrade immediately or implement rate-limiting and input size restrictions as mitigations.
Affected products
- The PHP League commonmark before 2.6.0
Timeline
- 2024-12-07: disclosed
- 2024-12-07: patched: Version 2.6.0 released with patch