Intel

AIKIDO-2026-785533

league/commonmark is vulnerable to Denial of Service (DoS)

GHSA-3q6v-r5mr-hxv8Published Sep 23, 2026
September 23, 2026

75

CVE Score

High

Denial of Service (DoS)

Are you affected? Scan for Free

TL;DR

The GitHub Flavored Markdown Table extension's block start parser reads the entire accumulated paragraph buffer and uses strpos to search for a pipe character on every non-blank line while a paragraph is open. For a paragraph of M lines with no pipes, this searches roughly k lines of buffer on line k, giving O(M^2) total work that grows with the size of the submitted Markdown. Rendering a single large paragraph of lines with no pipes through GithubFlavoredMarkdownConverter, or any environment with the Table extension enabled, uses CPU time that scales quadratically with body size and can exhaust worker processes. The fix checks only the current line for a delimiter row before using the paragraph buffer, removing the per line rescan.

How do I fix this?

Upgrade the league/commonmark library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you enable the Table extension, included by default in GithubFlavoredMarkdownConverter, to render Markdown from untrusted sources.

Versions

1.1.0 - 2.10.1

Fixed in 2.10.2

Background info

league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.1.0 - 2.10.1.

Get secure today,
quickly and for free.

Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.

No credit card required | Scan results in 32 seconds.

Trusted by 150k+ orgs
  • Revolut
  • n8n
  • Lovable
  • Deel
  • Prove
  • Omnea