Executive brief
league/commonmark is a PHP library used by websites to parse and render Markdown content. The library contains a performance flaw in its heading slug generation logic that causes it to perform redundant work when processing documents with many headings that normalize to identical names. An attacker can exploit this by submitting a Markdown document with many empty or identical headings, causing the server's CPU to spike and deny service to legitimate users, with no authentication required.
Technical details
The vulnerability is an algorithmic complexity flaw (CWE-407) in the UniqueSlugNormalizer::normalize() method. When multiple headings collapse to the same base slug (via empty ATX headings, identical text, or punctuation-only content), the normalizer restarts its numeric-suffix search from 1 on every collision, resulting in O(K²) time complexity for K colliding headings. The vulnerable code path is triggered whenever HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered and processes attacker-controlled Markdown. No authentication is required; a small document with many crafted headings can consume seconds of CPU, causing denial of service. The vulnerability affects all 2.x releases from 2.0.0 through 2.8.3; it was patched in version 2.9.0 by removing the quadratic behavior while preserving unique IDs.
Affected products
- league commonmark >= 2.0.0, < 2.8.4
Timeline
- 2026-08-03: disclosed: GitHub security advisory published
- 2026-09-07: patched: Patched in version 2.9.0