{"uuid": "bbdcf32b-5207-465f-b2f2-1928a775a5eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-MH25-X5HQ-WRQP", "type": "seen", "source": "https://gist.github.com/alon710/09e2e2055df2711d8dcc906978bf0f47", "content": "# GHSA-MH25-X5HQ-WRQP: GHSA-MH25-X5HQ-WRQP: Algorithmic Complexity Denial of Service in league/commonmark UniqueSlugNormalizer\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/GHSA-MH25-X5HQ-WRQP\n\n## Summary\nAn algorithmic complexity vulnerability in the UniqueSlugNormalizer component of the league/commonmark PHP library allows unauthenticated remote attackers to trigger severe CPU resource consumption and Denial of Service (DoS) by submitting a Markdown document containing a high volume of duplicate headings. The slug generation loop resets its sequential search index back to 1 for every collision, resulting in a quadratic execution path. This flaw affects versions from 2.0.0-beta1 up to and including 2.8.3, and is patched in version 2.9.0.\n\n## TL;DR\nA quadratic complexity flaw in league/commonmark's heading slug generator allows remote attackers to exhaust server CPU and trigger a total Denial of Service by submitting Markdown documents with thousands of identical headings.\n\n## Technical Details\n\n- **CWE ID**: CWE-400 (Uncontrolled Resource Consumption)\n- **Attack Vector**: Network / Unauthenticated\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: Proof-of-Concept (PoC) Available\n- **Vulnerability Class**: Algorithmic Complexity / Denial of Service\n- **Affected Component**: UniqueSlugNormalizer\n\n## Affected Systems\n\n- league/commonmark\n- **league/commonmark**: >= 2.0.0-beta1, <= 2.8.3 (Fixed in: `2.9.0`)\n\n## Mitigation\n\n- Upgrade to league/commonmark version 2.9.0 or higher.\n- Disable the HeadingPermalinkExtension if unique slug generation is not required.\n- Enforce input validation constraints to limit the maximum number of headings in Markdown inputs.\n\n**Remediation Steps:**\n1. Run `composer update league/commonmark` to update to the latest secure version.\n2. Verify installation by checking composer.lock for 'league/commonmark' >= 2.9.0.\n3. If upgrading is not possible, comment out or remove `$environment->addExtension(new HeadingPermalinkExtension());` from your setup config.\n\n## References\n\n- [GitHub Security Advisory GHSA-MH25-X5HQ-WRQP](https://github.com/advisories/GHSA-MH25-X5HQ-WRQP)\n- [league/commonmark v2.9.0 Release Notes](https://github.com/thephpleague/commonmark/releases/tag/2.9.0)\n- [league/commonmark Changelog](https://raw.githubusercontent.com/thephpleague/commonmark/2.9.0/CHANGELOG.md)\n- [Patched UniqueSlugNormalizer Source](https://raw.githubusercontent.com/thephpleague/commonmark/2.9.0/src/Normalizer/UniqueSlugNormalizer.php)\n- [Vulnerable UniqueSlugNormalizer Source](https://raw.githubusercontent.com/thephpleague/commonmark/2.8.3/src/Normalizer/UniqueSlugNormalizer.php)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-MH25-X5HQ-WRQP) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T13:34:35.083753Z"}