{"vulnerability": "ghsa-8rr7-cvq3-gmfh", "sightings": [{"uuid": "0e14817e-4524-4be2-b486-4570b84c8640", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8RR7-CVQ3-GMFH", "type": "seen", "source": "https://gist.github.com/alon710/0344ab3ccbb417e183823a5a2477945e", "content": "# GHSA-8RR7-CVQ3-GMFH: GHSA-8RR7-CVQ3-GMFH: Algorithmic Complexity Denial of Service in league/commonmark AttributesExtension\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/GHSA-8RR7-CVQ3-GMFH\n\n## Summary\nAn algorithmic complexity vulnerability (CWE-407) in the AttributesExtension of league/commonmark allows unauthenticated remote attackers to cause CPU exhaustion and Denial of Service (DoS) via crafted Markdown payloads containing adjacent or consecutive attributes.\n\n## TL;DR\nThe AttributesExtension in league/commonmark before 2.10.0 parses consecutive or adjacent HTML attributes in quadratic O(N^2) time, enabling remote denial of service via CPU exhaustion.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407 (Inefficient Algorithmic Complexity)\n- **Attack Vector**: Network / Unauthenticated API and HTTP endpoints\n- **CVSS Score**: 7.5 (High)\n- **Impact**: Denial of Service (CPU Exhaustion)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- league/commonmark\n- **league/commonmark**: < 2.10.0 (Fixed in: `2.10.0`)\n\n## Mitigation\n\n- Update league/commonmark to version 2.10.0 or higher.\n- Disable AttributesExtension if custom HTML attributes are not strictly required.\n- Implement request and input payload length limitations at the WAF or application level.\n- Enforce strict execution execution limits and timeouts for downstream parsing scripts.\n\n**Remediation Steps:**\n1. Modify composer.json to require \"league/commonmark\": \"^2.10.0\".\n2. Run `composer update league/commonmark` to pull the latest security release.\n3. Deploy the updated dependency lockfile to staging and production environments.\n4. Verify application functionality and performance using complex attribute patterns.\n\n## References\n\n- [GitHub Security Advisory GHSA-8RR7-CVQ3-GMFH](https://github.com/advisories/GHSA-8RR7-CVQ3-GMFH)\n- [Fix Commit Patch for AttributesExtension Performance Bottleneck](https://github.com/thephpleague/commonmark/commit/f27eb720972490b5af4dbb635ad8634529faf9f2)\n- [v2.10.0 Release Tag Information](https://github.com/thephpleague/commonmark/releases/tag/2.10.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-8RR7-CVQ3-GMFH) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T08:32:19.270504Z"}]}