Inefficient Algorithmic Complexity Affecting league/commonmark package, versions >=1.5.0, <2.9.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-LEAGUECOMMONMARK-18600656
- published9 Aug 2026
- disclosed6 Aug 2026
- creditUnknown
Introduced: 6 Aug 2026
New CVE NOT AVAILABLE CWE-407 (opens in a new tab)How to fix?
Upgrade league/commonmark to version 2.9.0 or higher.
Overview
league/commonmark is a PHP-based Markdown parser which supports the full CommonMark spec. It is based on the CommonMark JS reference implementation.
Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the FootnoteExtension process. An attacker can exhaust system resources and cause service disruption by submitting input with a high number of duplicate footnote references and definitions, leading to excessive memory and CPU consumption. This is only exploitable if the FootnoteExtension is enabled in the environment.
Workaround
This vulnerability can be mitigated by disabling the FootnoteExtension for untrusted input or enforcing a strict input-size limit before conversion, though the latter is a weak control and may require aggressive limits to be effective.