Executive brief
The League CommonMark library contains a denial-of-service vulnerability in its optional Attributes extension when processing markdown documents. An unauthenticated attacker can send a specially crafted 32 KB payload of repeated attribute blocks that causes the parser to consume excessive CPU time (over 5 seconds), degrading server performance and availability.
Technical details
The vulnerability is an inefficient algorithmic complexity flaw (CWE-407) in the AttributesListener::findTargetAndDirection() method within the Attributes extension. When processing adjacent inline attribute blocks, the resolver walks through all siblings to find a target, resulting in O(N²) time complexity for N adjacent blocks. An attacker can trigger this worst-case behavior by submitting repeated attribute block patterns (e.g., {#a} repeated 8,000 times) without authentication or user interaction required. No configuration gating or allowlist validation prevents the quadratic walk. A fix is available in version 2.9.0 or later.
Affected products
- League CommonMark 1.5.0 before 2.8.4
Timeline
- 2026-08-03: disclosed
- 2026-09-07: patched