league/commonmark is vulnerable to Denial of Service (DoS)
75
CVE Score
High
Denial of Service (DoS)
The Footnote extension appends the full list of recorded backrefs to every footnote definition block and never removes duplicate definitions of the same label. A document that references one label many times and supplies an equal number of duplicate definitions for it produces a quadratic number of backref nodes. Output size, parse time, and peak memory all grow quadratically, letting a small untrusted input exhaust memory and deny service. The fix keeps only the first definition of each label and stores backrefs under a single key so the amplification no longer occurs.
Upgrade the league/commonmark library to the patch version.
You are affected if you are using a version that falls within the vulnerable range and you use the Footnote extension to render untrusted Markdown input.
1.5.0 - 2.8.3
Fixed in 2.9.0league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.5.0 - 2.8.3.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.