{"vulnerability": "ghsa-j8pm-gj4c-rq4x", "sightings": [{"uuid": "f27ce830-0a89-4455-ba99-92f4db3a5695", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-J8PM-GJ4C-RQ4X", "type": "seen", "source": "https://gist.github.com/alon710/d11eade9d3460fb762a1734567ffc610", "content": "# GHSA-J8PM-GJ4C-RQ4X: GHSA-J8PM-GJ4C-RQ4X: Algorithmic Complexity Denial of Service in league/commonmark\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/GHSA-J8PM-GJ4C-RQ4X\n\n## Summary\nThe league/commonmark library is subject to multiple denial of service vulnerabilities. These stem from three independent algorithmic complexity weaknesses in Markdown parsing: regular expression backtracking, reference link normalization, and delimiter processing. Remote, unauthenticated attackers can exploit these flaws by submitting crafted Markdown input to exhaust CPU execution resources, leading to application-wide thread exhaustion.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust server CPU resources by submitting crafted Markdown payloads containing specific repetition patterns, causing application-wide denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407, CWE-1050, CWE-1333\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1**: 7.5\n- **Impact**: High (Denial of Service)\n- **Exploit Status**: Proof-of-Concept Available\n- **First Patched Version**: 2.9.1\n\n## Affected Systems\n\n- league/commonmark\n- **league/commonmark**: >= 0.6.0, < 2.9.1 (Fixed in: `2.9.1`)\n\n## Mitigation\n\n- Upgrade to league/commonmark 2.9.1 or higher\n- Deploy input filters to restrict maximum line length to 2000 characters\n- Configure strict execution timeouts in PHP-FPM and php.ini\n- Implement IP-based rate limiting on markdown conversion endpoints\n\n**Remediation Steps:**\n1. Run 'composer update league/commonmark' to update to version 2.9.1 or higher\n2. Verify that Composer lock file resolves to version 2.9.1 or higher\n3. Deploy the changes to staging environment and execute baseline performance tests\n4. Deploy updated application dependencies to production environment\n\n## References\n\n- [GitHub Security Advisory Entry](https://github.com/advisories/GHSA-J8PM-GJ4C-RQ4X)\n- [Official Advisory and Vulnerability Details](https://github.com/thephpleague/commonmark/security/advisories/GHSA-j8pm-gj4c-rq4x)\n- [Release Notes for league/commonmark v2.9.1](https://github.com/thephpleague/commonmark/releases/tag/2.9.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-J8PM-GJ4C-RQ4X) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T12:33:24.714804Z"}]}