Junglewise Threat Intelligence

league/commonmark denial of service in AttributesExtension

Severity: high · CVSS 7.5 · Published 2026-08-06

Executive brief

A vulnerability in the league/commonmark PHP library can allow an attacker to crash or slow down a website by submitting specially crafted text. The issue occurs when the optional Attributes extension is enabled, allowing a small amount of input to consume excessive server processing power. This can lead to a denial of service, making the affected application unavailable to legitimate users.

Technical details

An algorithmic complexity vulnerability (CWE-407) exists in the league/commonmark Attributes extension. The `AttributesListener::findTargetAndDirection()` function resolves attribute node targets by walking through siblings in a way that results in quadratic time complexity (O(N²)) when processing many adjacent inline attribute blocks. An unauthenticated remote attacker can exploit this by submitting a relatively small payload (e.g., 32 KB) to trigger high CPU usage and a denial of service. The vulnerability is present in all versions from 1.5.0 up to 2.9.0 when the AttributesExtension is enabled. A fix is available in version 2.9.0.

Affected products

  • league commonmark >= 1.5.0, < 2.9.0

Timeline

  • 2026-08-03: disclosed: Vulnerability published to thephpleague/commonmark repository.
  • 2026-08-06: advisory: GitHub Advisory published.
  • 2026-08-06: patched: Version 2.9.0 released with fix.

References

Related threats