AIKIDO-2026-849032
league/commonmark is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
league/commonmarkTL;DR
The unique slug normalizer makes each heading slug document-unique by searching for an unused numeric suffix but restarts that search from the first suffix on every collision. When many headings or inline footnote labels normalize to the same base slug, deduplicating them costs quadratic time. Untrusted Markdown with many empty or identically normalizing headings can therefore burn seconds of CPU and deny service. The fix tracks suffix state so slug deduplication runs in linear time while preserving unique identifiers.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the Heading Permalink, Table of Contents, or Footnote extension to render untrusted Markdown input.
Background info
league/commonmark is vulnerable to Denial of Service (DoS) in versions 2.0.0 - 2.8.3.
How to fix this
Upgrade the league/commonmark library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant