Executive brief
A vulnerability in the league/commonmark PHP library can allow an attacker to crash or slow down a website by submitting specially crafted text. The issue occurs when the optional Attributes extension is enabled, allowing a small amount of input to consume excessive server processing power. This can lead to a denial of service, making the affected application unavailable to legitimate users.
Technical details
An algorithmic complexity vulnerability (CWE-407) exists in the league/commonmark Attributes extension. The `AttributesListener::findTargetAndDirection()` function resolves attribute node targets by walking through siblings in a way that results in quadratic time complexity (O(N²)) when processing many adjacent inline attribute blocks. An unauthenticated remote attacker can exploit this by submitting a relatively small payload (e.g., 32 KB) to trigger high CPU usage and a denial of service. The vulnerability is present in all versions from 1.5.0 up to 2.9.0 when the AttributesExtension is enabled. A fix is available in version 2.9.0.
Affected products
- league commonmark >= 1.5.0, < 2.9.0
Timeline
- 2026-08-03: disclosed: Vulnerability published to thephpleague/commonmark repository.
- 2026-08-06: advisory: GitHub Advisory published.
- 2026-08-06: patched: Version 2.9.0 released with fix.
References
- https://api.github.com/users/GrahamCampbell
- https://github.com/GrahamCampbell
- https://api.github.com/users/GrahamCampbell/gists%7B/gist_id%7D
- https://api.github.com/users/GrahamCampbell/repos
- https://avatars.githubusercontent.com/u/2829600?v=4
- https://api.github.com/users/GrahamCampbell/events%7B/privacy%7D