DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-J8PM-GJ4C-RQ4X: GHSA-J8PM-GJ4C-RQ4X: Algorithmic Complexity Denial of Service in league/commonmark

#security #cve #cybersecurity #ghsa

GHSA-J8PM-GJ4C-RQ4X: Algorithmic Complexity Denial of Service in league/commonmark

Vulnerability ID: GHSA-J8PM-GJ4C-RQ4X
CVSS Score: 7.5
Published: 2026-09-01

The league/commonmark library is subject to multiple denial of service vulnerabilities. These stem from three independent algorithmic complexity weaknesses in Markdown parsing: regular expression backtracking, reference link normalization, and delimiter processing. Remote, unauthenticated attackers can exploit these flaws by submitting crafted Markdown input to exhaust CPU execution resources, leading to application-wide thread exhaustion.

TL;DR

Unauthenticated remote attackers can exhaust server CPU resources by submitting crafted Markdown payloads containing specific repetition patterns, causing application-wide denial of service.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-407, CWE-1050, CWE-1333
  • Attack Vector: Network (Unauthenticated)
  • CVSS v3.1: 7.5
  • Impact: High (Denial of Service)
  • Exploit Status: Proof-of-Concept Available
  • First Patched Version: 2.9.1

Affected Systems

  • league/commonmark
  • league/commonmark: >= 0.6.0, < 2.9.1 (Fixed in: 2.9.1)

Code Analysis

Commit: d9375fa

Fenced code block possessive regex quantifier change

Commit: 0768217

Link label length validation implementation

Commit: e0036ef

Cache key clamping for delimiter processing

Mitigation Strategies

  • Upgrade to league/commonmark 2.9.1 or higher
  • Deploy input filters to restrict maximum line length to 2000 characters
  • Configure strict execution timeouts in PHP-FPM and php.ini
  • Implement IP-based rate limiting on markdown conversion endpoints

Remediation Steps:

  1. Run 'composer update league/commonmark' to update to version 2.9.1 or higher
  2. Verify that Composer lock file resolves to version 2.9.1 or higher
  3. Deploy the changes to staging environment and execute baseline performance tests
  4. Deploy updated application dependencies to production environment

References

Read the full report for GHSA-J8PM-GJ4C-RQ4X on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)