Intel

AIKIDO-2026-276334

league/commonmark is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)GHSA-jfm3-95jq-q3rf Published 2 days ago

75

High Risk

This Affects:

PHPleague/commonmark
1.5.0 - 2.8.3
Fixed in 2.9.0
Are you affected? Scan for Free

TL;DR

The Footnote extension appends the full list of recorded backrefs to every footnote definition block and never removes duplicate definitions of the same label. A document that references one label many times and supplies an equal number of duplicate definitions for it produces a quadratic number of backref nodes. Output size, parse time, and peak memory all grow quadratically, letting a small untrusted input exhaust memory and deny service. The fix keeps only the first definition of each label and stores backrefs under a single key so the amplification no longer occurs.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use the Footnote extension to render untrusted Markdown input.

Background info

league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.5.0 - 2.8.3.

How to fix this

Upgrade the league/commonmark library to the patch version.