DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-8RR7-CVQ3-GMFH: GHSA-8RR7-CVQ3-GMFH: Algorithmic Complexity Denial of Service in league/commonmark AttributesExtension

#security #cve #cybersecurity #ghsa

GHSA-8RR7-CVQ3-GMFH: Algorithmic Complexity Denial of Service in league/commonmark AttributesExtension

Vulnerability ID: GHSA-8RR7-CVQ3-GMFH
CVSS Score: 7.5
Published: 2026-09-01

An algorithmic complexity vulnerability (CWE-407) in the AttributesExtension of league/commonmark allows unauthenticated remote attackers to cause CPU exhaustion and Denial of Service (DoS) via crafted Markdown payloads containing adjacent or consecutive attributes.

TL;DR

The AttributesExtension in league/commonmark before 2.10.0 parses consecutive or adjacent HTML attributes in quadratic O(N^2) time, enabling remote denial of service via CPU exhaustion.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-407 (Inefficient Algorithmic Complexity)
  • Attack Vector: Network / Unauthenticated API and HTTP endpoints
  • CVSS Score: 7.5 (High)
  • Impact: Denial of Service (CPU Exhaustion)
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • league/commonmark
  • league/commonmark: < 2.10.0 (Fixed in: 2.10.0)

Code Analysis

Commit: f27eb72

Optimize AttributesExtension to avoid quadratic execution times during compilation

Exploit Details

Mitigation Strategies

  • Update league/commonmark to version 2.10.0 or higher.
  • Disable AttributesExtension if custom HTML attributes are not strictly required.
  • Implement request and input payload length limitations at the WAF or application level.
  • Enforce strict execution execution limits and timeouts for downstream parsing scripts.

Remediation Steps:

  1. Modify composer.json to require "league/commonmark": "^2.10.0".
  2. Run composer update league/commonmark to pull the latest security release.
  3. Deploy the updated dependency lockfile to staging and production environments.
  4. Verify application functionality and performance using complex attribute patterns.

References

Read the full report for GHSA-8RR7-CVQ3-GMFH on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)