GHSA-MH25-X5HQ-WRQP: GHSA-MH25-X5HQ-WRQP: Algorithmic Complexity Denial of Service in league/commonmark UniqueSlugNormalizer

#security #cve #cybersecurity #ghsa

GHSA-MH25-X5HQ-WRQP: Algorithmic Complexity Denial of Service in league/commonmark UniqueSlugNormalizer

Vulnerability ID: GHSA-MH25-X5HQ-WRQP
CVSS Score: 7.5
Published: 2026-08-06

An algorithmic complexity vulnerability in the UniqueSlugNormalizer component of the league/commonmark PHP library allows unauthenticated remote attackers to trigger severe CPU resource consumption and Denial of Service (DoS) by submitting a Markdown document containing a high volume of duplicate headings. The slug generation loop resets its sequential search index back to 1 for every collision, resulting in a quadratic execution path. This flaw affects versions from 2.0.0-beta1 up to and including 2.8.3, and is patched in version 2.9.0.

TL;DR

A quadratic complexity flaw in league/commonmark's heading slug generator allows remote attackers to exhaust server CPU and trigger a total Denial of Service by submitting Markdown documents with thousands of identical headings.

Technical Details

CWE ID: CWE-400 (Uncontrolled Resource Consumption)
Attack Vector: Network / Unauthenticated
CVSS v3.1 Score: 7.5 (High)
Exploit Status: Proof-of-Concept (PoC) Available
Vulnerability Class: Algorithmic Complexity / Denial of Service
Affected Component: UniqueSlugNormalizer

Affected Systems

league/commonmark
league/commonmark: >= 2.0.0-beta1, <= 2.8.3 (Fixed in: 2.9.0)

Mitigation Strategies

Upgrade to league/commonmark version 2.9.0 or higher.
Disable the HeadingPermalinkExtension if unique slug generation is not required.
Enforce input validation constraints to limit the maximum number of headings in Markdown inputs.

Remediation Steps:

Run composer update league/commonmark to update to the latest secure version.
Verify installation by checking composer.lock for 'league/commonmark' >= 2.9.0.
If upgrading is not possible, comment out or remove $environment->addExtension(new HeadingPermalinkExtension()); from your setup config.