Inefficient Algorithmic Complexity Affecting league/commonmark package, versions >=2.0.0, <2.9.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-LEAGUECOMMONMARK-18600664
- published9 Aug 2026
- disclosed6 Aug 2026
- creditUnknown
Introduced: 6 Aug 2026
New CVE NOT AVAILABLE CWE-407 (opens in a new tab)How to fix?
Upgrade league/commonmark to version 2.9.0 or higher.
Overview
league/commonmark is a PHP-based Markdown parser which supports the full CommonMark spec. It is based on the CommonMark JS reference implementation.
Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the UniqueSlugNormalizer::normalize process. An attacker can exhaust system resources by submitting multiple headings that normalize to the same base slug, causing excessive array lookups and significant CPU consumption. This is only exploitable if the document is processed with the default slug_normalizer/unique setting enabled and attacker-controlled text is parsed by the slug normalizer.
Workaround
This vulnerability can be mitigated by setting slug_normalizer/unique to false, disabling HeadingPermalinkExtension and related extensions for untrusted input, or capping the accepted document size or heading count upstream.