Intel

AIKIDO-2026-276334

league/commonmark is vulnerable to Denial of Service (DoS)

GHSA-jfm3-95jq-q3rfPublished Aug 5, 2026
August 5, 2026

75

CVE Score

High

Denial of Service (DoS)

Are you affected? Scan for Free

TL;DR

The Footnote extension appends the full list of recorded backrefs to every footnote definition block and never removes duplicate definitions of the same label. A document that references one label many times and supplies an equal number of duplicate definitions for it produces a quadratic number of backref nodes. Output size, parse time, and peak memory all grow quadratically, letting a small untrusted input exhaust memory and deny service. The fix keeps only the first definition of each label and stores backrefs under a single key so the amplification no longer occurs.

How do I fix this?

Upgrade the league/commonmark library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use the Footnote extension to render untrusted Markdown input.

Versions

1.5.0 - 2.8.3

Fixed in 2.9.0

Background info

league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.5.0 - 2.8.3.

Get secure today,
quickly and for free.

Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.

No credit card required | Scan results in 32 seconds.

Trusted by 150k+ orgs
  • Revolut
  • n8n
  • Lovable
  • Deel
  • Prove
  • Omnea