{"vulnerability": "ghsa-jjv6-8j6v-6j52", "sightings": [{"uuid": "a8e942bf-96b3-4379-8df4-b689fe6569aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-JJV6-8J6V-6J52", "type": "seen", "source": "https://gist.github.com/alon710/c47fcd7d502f07dd0b771d6c1a947594", "content": "# GHSA-JJV6-8J6V-6J52: GHSA-JJV6-8J6V-6J52: Algorithmic Complexity Denial of Service in league/commonmark\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/GHSA-JJV6-8J6V-6J52\n\n## Summary\nGHSA-JJV6-8J6V-6J52 details multiple algorithmic complexity issues in the SmartPunct and Attributes extensions of the league/commonmark PHP library, leading to high CPU consumption and Denial of Service (DoS) when parsing pathological Markdown inputs.\n\n## TL;DR\nUnauthenticated Denial of Service vulnerability in league/commonmark via algorithmic complexity flaws in SmartPunct and Attributes extensions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400 / CWE-1333\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **CISA KEV Status**: Not Listed\n- **Impact**: Denial of Service (DoS) via CPU and Memory Exhaustion\n\n## Affected Systems\n\n- league/commonmark PHP library\n- **league/commonmark**: < 2.9.1 (Fixed in: `2.9.1`)\n\n## Mitigation\n\n- Upgrade league/commonmark library to version 2.9.1 or higher.\n- Disable the SmartPunctExtension and AttributesExtension in the environment configuration if upgrading is not possible.\n- Apply WAF filters to inspect and block payloads containing high repetition of adjacent quotes or consecutive attribute definitions.\n\n**Remediation Steps:**\n1. Verify the installed version of league/commonmark using 'composer show league/commonmark'.\n2. Run 'composer update league/commonmark' to update to version 2.9.1 or newer.\n3. Review the application's markdown converter configuration to ensure no obsolete workarounds are breaking the layout.\n\n## References\n\n- [GitHub Security Advisory GHSA-JJV6-8J6V-6J52](https://github.com/advisories/GHSA-JJV6-8J6V-6J52)\n- [league/commonmark v2.9.1 Release Notes](https://github.com/thephpleague/commonmark/releases/tag/2.9.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-JJV6-8J6V-6J52) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T10:32:15.235956Z"}]}