Executive brief
league/commonmark is a popular PHP library that converts Markdown text into HTML. An attacker can submit specially crafted Markdown documents to the conversion function, causing the library to consume excessive CPU time and preventing legitimate requests from being processed. This is a denial-of-service vulnerability that can take a web application offline or degrade its performance without requiring authentication or complex attack setup.
Technical details
league/commonmark versions 0.6.0 through 2.9.0 contain three independent algorithmic complexity vulnerabilities triggered during Markdown parsing: (1) quadratic behavior in fenced code block detection via non-atomic regex backreferences on long backtick runs; (2) quadratic behavior in reference link label normalization via repeated string operations on nested brackets; and (3) super-linear (approximately O(n^1.5)) behavior in emphasis delimiter processing due to unbounded cache key space. All three paths are reachable on a default CommonMarkConverter with no configuration changes or extensions needed. An unauthenticated attacker can craft a single-line input (e.g., 320 KB of backticks, deeply nested brackets, or delimiter sequences) to trigger sustained CPU consumption taking 20+ seconds. Repeated or concurrent requests exhaust available PHP workers. The vulnerability is patched in version 2.9.1 with possessive quantifiers and improved cache keying.
Affected products
- The League commonmark 0.6.0 to 2.9.0
Timeline
- 2026-08-09: disclosed
- 2026-08-09: patched: Version 2.9.1 released