Executive brief
league/commonmark is a widely-used PHP Markdown parser library. Two of its optional extensions contain algorithmic inefficiencies that allow an attacker to submit specially crafted Markdown input that consumes excessive CPU time, preventing legitimate requests from being processed. An unauthenticated attacker can trigger this issue by submitting Markdown to any application using these extensions, leading to service outages and business disruption.
Technical details
Three distinct quadratic-complexity parsing paths exist in league/commonmark when the SmartPunct or Attributes extensions are explicitly registered (not included in default converters). First, the SmartPunctExtension's ReplaceUnpairedQuotesListener performs inefficient text node merging by repeatedly re-copying the entire accumulated literal instead of appending only new bytes, causing O(n²) string operations. Second, the AttributesExtension's findTargetAndDirection() method walks all remaining siblings for each block-level Attributes node, resulting in O(k²) steps for a contiguous run of k nodes. Third, mergeAttributes() round-trips class lists through explode/implode operations on every merge, incurring repeated O(n) string operations. Attack preconditions: the application must explicitly register at least one vulnerable extension and accept untrusted Markdown input. The extensions are not enabled by default in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension. No authentication is required and no user interaction is needed beyond submitting Markdown. The fixes in 2.9.1 optimize text merging to append in-place, cache sibling walks to process each run once, and batch class list operations.
Affected products
- league commonmark 1.5.0 through 2.9.0
Timeline
- 2026-08-09: disclosed
- 2026-09-01: patched: Fixed in version 2.9.1