league/commonmark is vulnerable to Denial of Service (DoS)
75
High Risk
The Footnote extension appends the full list of recorded backrefs to every footnote definition block and never removes duplicate definitions of the same label. A document that references one label many times and supplies an equal number of duplicate definitions for it produces a quadratic number of backref nodes. Output size, parse time, and peak memory all grow quadratically, letting a small untrusted input exhaust memory and deny service. The fix keeps only the first definition of each label and stores backrefs under a single key so the amplification no longer occurs.
You are affected if you are using a version that falls within the vulnerable range and you use the Footnote extension to render untrusted Markdown input.
league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.5.0 - 2.8.3.
Upgrade the league/commonmark library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant