Executive brief
The league/commonmark PHP library's optional Attributes extension has a performance flaw that allows unauthenticated attackers to cause a denial of service by submitting specially crafted Markdown input. When processing attributes with distinct names, the extension re-processes the entire accumulated attribute set for each new attribute, leading to quadratic (O(n²)) computational complexity. An attacker can submit a small Markdown file that causes the server to consume excessive CPU time, preventing legitimate requests from being processed.
Technical details
The vulnerability is a quadratic algorithm complexity issue (CWE-407, CWE-1050) affecting the Attributes extension of league/commonmark. Two code paths are affected: (1) AttributesListener::processDocument() which re-merges and re-filters the entire accumulated attribute set each time a new attribute node is added, causing O(n²) complexity when processing n attributes with distinct names; and (2) AttributesBlockContinueParser::tryContinue() in version 2.0.0+ which similarly re-processes all accumulated attributes on each continuation line. The vulnerability requires explicit registration of AttributesExtension, which is not enabled by default. An unauthenticated attacker can submit untrusted Markdown (e.g., 256 KB of adjacent inline attributes taking 20 seconds to process, versus 0.09 seconds post-patch) to exhaust PHP worker resources. The patch in version 2.10.0 optimizes both paths to accumulate attributes in linear time. Affected versions: 1.5.0–2.9.2 (listener path), 2.0.0–2.9.2 (continuation-line path).
Affected products
- The PHP League commonmark 1.5.0 through 2.9.2
Timeline
- 2026-09-01: disclosed: Advisory published to GitHub Advisory Database
- 2026-09-01: patched: Version 2.10.0 released with fix