Executive brief
commonmark is a Markdown parser library used to convert Markdown documents into HTML. The AttributesExtension component has a denial-of-service flaw where attackers can submit specially crafted Markdown with many distinct attribute names to trigger inefficient attribute processing that consumes excessive CPU resources, causing service slowdowns and preventing legitimate requests from completing.
Technical details
The vulnerability is an inefficient algorithmic complexity flaw (CWE-407) in the AttributesExtension component. Two code paths exhibit quadratic time complexity (O(n²)) when processing attributes: (1) AttributesListener::processDocument() merges and filters attributes using full set traversal for each node, and (2) AttributesBlockContinueParser::tryContinue() rebuilds the entire accumulated attribute set on each continuation line. Attackers can submit untrusted Markdown with numerous distinct attribute names (via inline attributes like {a0="v"}{a1="v"}... or consecutive attribute blocks) to trigger this quadratic behavior with minimal input. No privileges, authentication, or user interaction is required; the attack is remotely exploitable via network. The AttributesExtension must be explicitly registered by the application to be vulnerable; default converters are not affected. Affected versions range from 1.5.0 to 2.9.2, with patches available in version 2.10.0 and later.
Affected products
- PHP League commonmark 1.5.0 to 2.9.2
Timeline
- 2026-08-11: disclosed
- 2026-09-07: advisory
- 2026-09-07: patched: version 2.10.0