# league/commonmark denial of service in AttributesExtension

Source: https://junglewise.ai/threats/league-commonmark-denial-of-service-in-attributesextension-c631ba68  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-08-06  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-08-06

A vulnerability in the league/commonmark PHP library can allow an attacker to crash or slow down a website by submitting specially crafted text. The issue occurs when the optional Attributes extension is enabled, allowing a small amount of input to consume excessive server processing power. This can lead to a denial of service, making the affected application unavailable to legitimate users.

Technologies: [league/commonmark (Packagist)](https://junglewise.ai/threats/technologies/league-commonmark). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 6 August 2026.

**Which products and versions are affected?** league/commonmark (Packagist) >= 1.5.0, < 2.9.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-08-06: Version 2.9.0 released with fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run league/commonmark (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An algorithmic complexity vulnerability (CWE-407) exists in the league/commonmark Attributes extension. The `AttributesListener::findTargetAndDirection()` function resolves attribute node targets by walking through siblings in a way that results in quadratic time complexity (O(N²)) when processing many adjacent inline attribute blocks. An unauthenticated remote attacker can exploit this by submitting a relatively small payload (e.g., 32 KB) to trigger high CPU usage and a denial of service. The vulnerability is present in all versions from 1.5.0 up to 2.9.0 when the AttributesExtension is enabled. A fix is available in version 2.9.0.

## Affected products

- league commonmark >= 1.5.0, < 2.9.0

## Timeline

- 2026-08-03: disclosed: Vulnerability published to thephpleague/commonmark repository.
- 2026-08-06: advisory: GitHub Advisory published.
- 2026-08-06: patched: Version 2.9.0 released with fix.

## References

- [https://api.github.com/users/GrahamCampbell](https://api.github.com/users/GrahamCampbell)
- [https://github.com/GrahamCampbell](https://github.com/GrahamCampbell)
- [https://api.github.com/users/GrahamCampbell/gists%7B/gist_id%7D](https://api.github.com/users/GrahamCampbell/gists%7B/gist_id%7D)
- [https://api.github.com/users/GrahamCampbell/repos](https://api.github.com/users/GrahamCampbell/repos)
- [https://avatars.githubusercontent.com/u/2829600?v=4](https://avatars.githubusercontent.com/u/2829600?v=4)
- [https://api.github.com/users/GrahamCampbell/events%7B/privacy%7D](https://api.github.com/users/GrahamCampbell/events%7B/privacy%7D)

## Related threats

- [league/commonmark DisallowedRawHtml XSS bypass in tag parsing](https://junglewise.ai/threats/league-commonmark-disallowedrawhtml-bypassed-when-a-disallowed-tag-name-cea607bc)
- [league/commonmark quadratic DoS in GitHub Flavored Markdown table parser](https://junglewise.ai/threats/league-commonmark-quadratic-time-denial-of-service-in-the-github-a4135205)
- [league/commonmark polynomial time complexity denial of service](https://junglewise.ai/threats/cve-2024-58382-league-commonmark-polynomial-time-complexity-denial-of-service)
- [league/commonmark AttributesExtension XSS bypass with U+000C](https://junglewise.ai/threats/cve-2026-86431-league-commonmark-attributesextension-xss-bypass-with-u-000c)
- [league/commonmark denial of service in parsing](https://junglewise.ai/threats/cve-2026-86430-league-commonmark-denial-of-service-in-parsing)