Intel

AIKIDO-2026-785533

league/commonmark is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)GHSA-3q6v-r5mr-hxv8 Published 2 days ago

75

High Risk

This Affects:

PHPleague/commonmark
1.1.0 - 2.10.1
Fixed in 2.10.2
Are you affected? Scan for Free

TL;DR

The GitHub Flavored Markdown Table extension's block start parser reads the entire accumulated paragraph buffer and uses strpos to search for a pipe character on every non-blank line while a paragraph is open. For a paragraph of M lines with no pipes, this searches roughly k lines of buffer on line k, giving O(M^2) total work that grows with the size of the submitted Markdown. Rendering a single large paragraph of lines with no pipes through GithubFlavoredMarkdownConverter, or any environment with the Table extension enabled, uses CPU time that scales quadratically with body size and can exhaust worker processes. The fix checks only the current line for a delimiter row before using the paragraph buffer, removing the per line rescan.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you enable the Table extension, included by default in GithubFlavoredMarkdownConverter, to render Markdown from untrusted sources.

Background info

league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.1.0 - 2.10.1.

How to fix this

Upgrade the league/commonmark library to the patch version.

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform