GHSA-JJV6-8J6V-6J52: Algorithmic Complexity Denial of Service in league/commonmark
Vulnerability ID: GHSA-JJV6-8J6V-6J52
CVSS Score: 7.5
Published: 2026-09-01
GHSA-JJV6-8J6V-6J52 details multiple algorithmic complexity issues in the SmartPunct and Attributes extensions of the league/commonmark PHP library, leading to high CPU consumption and Denial of Service (DoS) when parsing pathological Markdown inputs.
TL;DR
Unauthenticated Denial of Service vulnerability in league/commonmark via algorithmic complexity flaws in SmartPunct and Attributes extensions.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-400 / CWE-1333
- Attack Vector: Network (Unauthenticated)
- CVSS v3.1 Score: 7.5 (High)
- Exploit Status: Proof of Concept (PoC) available
- CISA KEV Status: Not Listed
- Impact: Denial of Service (DoS) via CPU and Memory Exhaustion
Affected Systems
- league/commonmark PHP library
-
league/commonmark: < 2.9.1 (Fixed in:
2.9.1)
Code Analysis
Commit: 04a5d11
Append in place when merging adjacent text nodes (GHSA-jjv6-8j6v-6j52)
Commit: 2f611b5
Fix quadratic attribute block and class list resolution (GHSA-jjv6-8j6v-6j52)
Mitigation Strategies
- Upgrade league/commonmark library to version 2.9.1 or higher.
- Disable the SmartPunctExtension and AttributesExtension in the environment configuration if upgrading is not possible.
- Apply WAF filters to inspect and block payloads containing high repetition of adjacent quotes or consecutive attribute definitions.
Remediation Steps:
- Verify the installed version of league/commonmark using 'composer show league/commonmark'.
- Run 'composer update league/commonmark' to update to version 2.9.1 or newer.
- Review the application's markdown converter configuration to ensure no obsolete workarounds are breaking the layout.
References
Read the full report for GHSA-JJV6-8J6V-6J52 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)