Executive brief
League CommonMark is a PHP library that converts Markdown text into HTML. An unauthenticated attacker can submit specially crafted Markdown to the converter that triggers super-linear CPU consumption through three independent parsing flaws, causing service unavailability. A single malicious line of text can consume disproportionate CPU time, and repeated requests can exhaust all PHP workers and prevent legitimate traffic from being processed.
Technical details
The vulnerability comprises three independent denial-of-service vectors reachable with default configuration: (1) A quadratic regex backtracking issue in FencedCodeStartParser where the fenced code block regex uses a non-possessive quantifier with lookahead, causing O(n²) work on crafted backtick runs; (2) A quadratic label normalization issue in reference link parsing where nested brackets trigger repeated string normalization operations (trim, regex, encoding checks, case conversion) against labels up to 64,000 characters long; (3) A super-linear (approximately n^1.5) algorithm regression in delimiter caching for emphasis, strikethrough, and highlight delimiters where cache keys embed unbounded run lengths instead of bounded buckets. Each trigger fits on a single line; a 320 KB or 800 KB payload consumes approximately 27 seconds of CPU. The work occurs during parsing before rendering, so configuration options like `max_nesting_level` do not mitigate the issue. Patches are available in version 2.9.1 and later, which make the regex quantifier possessive, enforce the CommonMark 999-character label limit before normalization, and clamp cache keys to O(1) key space.
Affected products
- The PHP League CommonMark 0.6.0 through 2.9.0
Timeline
- 2026-08-09: disclosed
- 2026-09-01: advisory
- 2026-09-01: patched: Version 2.9.1 and later