Intel

AIKIDO-2026-276334

league/commonmark is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)GHSA-jfm3-95jq-q3rf Published Aug 5, 2026

75

High Risk

This Affects:

PHPleague/commonmark
1.5.0 - 2.8.3
Fixed in 2.9.0
Are you affected? Scan for Free

TL;DR

The Footnote extension appends the full list of recorded backrefs to every footnote definition block and never removes duplicate definitions of the same label. A document that references one label many times and supplies an equal number of duplicate definitions for it produces a quadratic number of backref nodes. Output size, parse time, and peak memory all grow quadratically, letting a small untrusted input exhaust memory and deny service. The fix keeps only the first definition of each label and stores backrefs under a single key so the amplification no longer occurs.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use the Footnote extension to render untrusted Markdown input.

Background info

league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.5.0 - 2.8.3.

How to fix this

Upgrade the league/commonmark library to the patch version.

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform