AIKIDO-2026-67636

league/commonmark is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)GHSA-2q4p-g7hv-5rgv Published 2 days ago

High Risk

This Affects:

league/commonmark

0.6.0 - 2.8.3

Fixed in 2.9.0

Are you affected? Scan for Free

TL;DR

The parser tracks locations by character position while regular-expression matches report byte positions, and several parsing paths repeatedly rescan growing portions of a line to translate between the two whenever the line contains a multibyte character. The Autolink extension similarly copies and revalidates the remaining line at every URL-like prefix. A single crafted line can drive quadratic time complexity, letting untrusted Markdown consume disproportionate CPU and memory and exhaust available workers. The fix records character-to-byte positions incrementally and matches autolinks against the original line so work grows in proportion to input size.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you convert untrusted or externally influenced Markdown input. The core parser paths (CommonMarkConverter, GithubFlavoredMarkdownConverter, and custom environments) are reachable by default with no extension required; enabling the Autolink or GitHub-Flavored Markdown extension adds an additional trigger. Applications that only process trusted Markdown are not remotely exploitable.