Intel

AIKIDO-2026-550503

league/commonmark is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)GHSA-8rr7-cvq3-gmfh Published Aug 14, 2026

75

High Risk

This Affects:

PHPleague/commonmark
1.5.0 - 2.9.2
Fixed in 2.10.0
Are you affected? Scan for Free

TL;DR

The AttributesExtension re-processes every attribute a node has already collected each time another attribute is applied to it, in both the inline attribute listener and the block-level continuation parser. When attributes carry distinct names, the accumulated set is rebuilt with array_merge and re-filtered on every step, so a run of distinctly-named attributes costs quadratic time. User-controlled Markdown containing long runs of adjacent inline attributes or consecutive attribute-block lines forces disproportionate CPU work from a small request, occupying PHP workers and preventing legitimate requests from completing. The fix folds each node or line into the accumulated attributes at a cost proportional to that node alone, leaving rendered output unchanged.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you have explicitly registered the AttributesExtension on your Environment to convert untrusted Markdown.

Background info

league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.5.0 - 2.9.2.

How to fix this

Upgrade the league/commonmark library to the patch version.

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform