Intel

AIKIDO-2026-550503

league/commonmark is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)GHSA-8rr7-cvq3-gmfh Published Aug 14, 2026

75

High Risk

This Affects:

PHPleague/commonmark
1.5.0 - 2.9.2
Fixed in 2.10.0
Are you affected? Scan for Free

TL;DR

The AttributesExtension re-processes every attribute a node has already collected each time another attribute is applied to it, in both the inline attribute listener and the block-level continuation parser. When attributes carry distinct names, the accumulated set is rebuilt with array_merge and re-filtered on every step, so a run of distinctly-named attributes costs quadratic time. User-controlled Markdown containing long runs of adjacent inline attributes or consecutive attribute-block lines forces disproportionate CPU work from a small request, occupying PHP workers and preventing legitimate requests from completing. The fix folds each node or line into the accumulated attributes at a cost proportional to that node alone, leaving rendered output unchanged.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you have explicitly registered the AttributesExtension on your Environment to convert untrusted Markdown.

Background info

league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.5.0 - 2.9.2.

How to fix this

Upgrade the league/commonmark library to the patch version.