# league commonmark denial of service in Footnote extension

Source: https://junglewise.ai/threats/league-commonmark-denial-of-service-in-footnote-extension-90371ead  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-08-06  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-08-06

A denial-of-service vulnerability exists in the league/commonmark PHP library, which is used to convert Markdown text into HTML. By providing a specially crafted Markdown document with many duplicate footnote definitions, an attacker can cause the server to consume excessive CPU and memory. This can lead to the application crashing or becoming unresponsive, effectively shutting down the service for legitimate users.

Technologies: [league/commonmark (Packagist)](https://junglewise.ai/threats/technologies/league-commonmark). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 6 August 2026.

**Which products and versions are affected?** league/commonmark (Packagist) >= 1.5.0, < 2.9.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-08-06: Version 2.9.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run league/commonmark (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Footnote extension in league/commonmark suffers from an inefficient algorithmic complexity issue (CWE-407) when handling duplicate footnote definitions. The `GatherFootnotesListener` appends the entire backref list for every footnote definition block without de-duplication, leading to O(N²) growth in output size, parse time, and memory usage. An unauthenticated attacker can exploit this by submitting a small (~10 KB) payload containing N references and N duplicate definitions, which can result in significant resource exhaustion (e.g., ~440 MB peak memory) and trigger Out-of-Memory (OOM) errors in PHP workers. The vulnerability is present in the opt-in FootnoteExtension and is fixed in version 2.9.0.

## Affected products

- league commonmark >= 1.5.0, < 2.9.0

## Timeline

- 2026-08-03: disclosed: Initial disclosure to maintainers
- 2026-08-06: advisory: GitHub Advisory published
- 2026-08-06: patched: Version 2.9.0 released

## References

- [https://api.github.com/users/GrahamCampbell](https://api.github.com/users/GrahamCampbell)
- [https://github.com/GrahamCampbell](https://github.com/GrahamCampbell)
- [https://api.github.com/users/GrahamCampbell/gists%7B/gist_id%7D](https://api.github.com/users/GrahamCampbell/gists%7B/gist_id%7D)
- [https://api.github.com/users/GrahamCampbell/repos](https://api.github.com/users/GrahamCampbell/repos)
- [https://avatars.githubusercontent.com/u/2829600?v=4](https://avatars.githubusercontent.com/u/2829600?v=4)
- [https://api.github.com/users/GrahamCampbell/events%7B/privacy%7D](https://api.github.com/users/GrahamCampbell/events%7B/privacy%7D)

## Related threats

- [league/commonmark DisallowedRawHtml XSS bypass in tag parsing](https://junglewise.ai/threats/league-commonmark-disallowedrawhtml-bypassed-when-a-disallowed-tag-name-cea607bc)
- [league/commonmark quadratic DoS in GitHub Flavored Markdown table parser](https://junglewise.ai/threats/league-commonmark-quadratic-time-denial-of-service-in-the-github-a4135205)
- [league/commonmark polynomial time complexity denial of service](https://junglewise.ai/threats/cve-2024-58382-league-commonmark-polynomial-time-complexity-denial-of-service)
- [league/commonmark AttributesExtension XSS bypass with U+000C](https://junglewise.ai/threats/cve-2026-86431-league-commonmark-attributesextension-xss-bypass-with-u-000c)
- [league/commonmark denial of service in parsing](https://junglewise.ai/threats/cve-2026-86430-league-commonmark-denial-of-service-in-parsing)