Executive brief
A vulnerability in the league/commonmark library, a popular tool for converting Markdown text to HTML in PHP applications, allows an attacker to crash or slow down a website. By submitting a specially crafted Markdown request with long lines or specific characters, an attacker can force the server to consume excessive CPU resources. This can lead to a denial-of-service (DoS) condition where the website becomes unresponsive to legitimate users.
Technical details
The league/commonmark library is vulnerable to a quadratic-time complexity denial-of-service (DoS) attack during Markdown parsing. The root cause is inefficient algorithmic complexity (CWE-407) when translating between character positions and byte positions in UTF-8 strings, as well as inefficient suffix copying in the Autolink extension. An attacker can trigger this by providing a single long line containing non-ASCII characters, repeated punctuation, or multiple URL-like prefixes. This causes the parser to repeatedly rescan growing portions of the input, leading to excessive CPU and memory consumption that can exhaust PHP worker processes. The issue is resolved in version 2.9.0 by implementing incremental position tracking and optimized matching.
Affected products
- league commonmark >= 0.6.0, < 2.9.0
Timeline
- 2026-08-03: patched: Version 2.9.0 released
- 2026-08-06: advisory: GitHub Advisory published
References
- https://api.github.com/users/GrahamCampbell
- https://github.com/GrahamCampbell
- https://api.github.com/users/GrahamCampbell/gists%7B/gist_id%7D
- https://api.github.com/users/GrahamCampbell/repos
- https://avatars.githubusercontent.com/u/2829600?v=4
- https://api.github.com/users/GrahamCampbell/events%7B/privacy%7D