AIKIDO-2026-67636

league/commonmark is vulnerable to Denial of Service (DoS)

CVE-2026-71488Published Aug 5, 2026

CVE Score

High

Denial of Service (DoS)

TL;DR

The parser tracks locations by character position while regular-expression matches report byte positions, and several parsing paths repeatedly rescan growing portions of a line to translate between the two whenever the line contains a multibyte character. The Autolink extension similarly copies and revalidates the remaining line at every URL-like prefix. A single crafted line can drive quadratic time complexity, letting untrusted Markdown consume disproportionate CPU and memory and exhaust available workers. The fix records character-to-byte positions incrementally and matches autolinks against the original line so work grows in proportion to input size.

How do I fix this?

Upgrade the league/commonmark library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you convert untrusted or externally influenced Markdown input. The core parser paths (CommonMarkConverter, GithubFlavoredMarkdownConverter, and custom environments) are reachable by default with no extension required; enabling the Autolink or GitHub-Flavored Markdown extension adds an additional trigger. Applications that only process trusted Markdown are not remotely exploitable.