Executive brief
The League CommonMark library, a PHP Markdown parser, contains inefficient parsing algorithms in two optional extensions (SmartPunct and Attributes) that must be explicitly enabled. An attacker can craft small Markdown documents with repeated elements (quotes, attribute blocks, or class attributes) that trigger exponential CPU consumption, causing the application to become unresponsive and unable to process legitimate requests. This vulnerability only affects applications that explicitly enable these extensions—they are disabled by default.
Technical details
The vulnerability comprises three distinct quadratic parsing paths: (1) SmartPunctExtension's quote replacement re-copies entire text node contents for each unpaired quote during merging, causing O(n²) behavior; (2) AttributesExtension's block-level attribute processing re-scans the entire sibling chain for each attribute node in a contiguous run (O(k²) cost for k nodes); (3) AttributesExtension's class list handling rebuilds and merges attributes via explode/implode on each operation, creating O(n³) cost. An unauthenticated attacker can submit specially crafted Markdown to trigger disproportionate CPU consumption and cause denial of service. The extensions must be explicitly registered; they are not included in standard CommonMark or GitHub-Flavored Markdown converters. Fixed in version 2.9.1.
Affected products
- League CommonMark >=1.5.0, <2.9.1
Timeline
- 2026-08-09: disclosed
- 2026-09-07: patched: Fixed in version 2.9.1