Executive brief
A denial-of-service vulnerability exists in the league/commonmark PHP library, which is used to convert Markdown text into HTML. By providing a specially crafted Markdown document with many duplicate footnote definitions, an attacker can cause the server to consume excessive CPU and memory. This can lead to the application crashing or becoming unresponsive, effectively shutting down the service for legitimate users.
Technical details
The Footnote extension in league/commonmark suffers from an inefficient algorithmic complexity issue (CWE-407) when handling duplicate footnote definitions. The `GatherFootnotesListener` appends the entire backref list for every footnote definition block without de-duplication, leading to O(N²) growth in output size, parse time, and memory usage. An unauthenticated attacker can exploit this by submitting a small (~10 KB) payload containing N references and N duplicate definitions, which can result in significant resource exhaustion (e.g., ~440 MB peak memory) and trigger Out-of-Memory (OOM) errors in PHP workers. The vulnerability is present in the opt-in FootnoteExtension and is fixed in version 2.9.0.
Affected products
- league commonmark >= 1.5.0, < 2.9.0
Timeline
- 2026-08-03: disclosed: Initial disclosure to maintainers
- 2026-08-06: advisory: GitHub Advisory published
- 2026-08-06: patched: Version 2.9.0 released
References
- https://api.github.com/users/GrahamCampbell
- https://github.com/GrahamCampbell
- https://api.github.com/users/GrahamCampbell/gists%7B/gist_id%7D
- https://api.github.com/users/GrahamCampbell/repos
- https://avatars.githubusercontent.com/u/2829600?v=4
- https://api.github.com/users/GrahamCampbell/events%7B/privacy%7D