Inefficient Algorithmic Complexity Affecting league/commonmark package, versions >=1.5.0, <2.10.0

league/commonmark is a PHP-based Markdown parser which supports the full CommonMark spec. It is based on the CommonMark JS reference implementation.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the AttributesListener::processDocument() and AttributesBlockContinueParser::tryContinue() paths in src/Extension/Attributes/Event/AttributesListener.php and src/Extension/Attributes/Parser/AttributesBlockContinueParser.php. An attacker can consume excessive CPU and stall PHP workers by sending Markdown with long runs of distinctly named attributes, either as adjacent inline attributes, attribute blocks on consecutive lines, or attribute blocks chained through reference definitions. The extension re-merges and re-filters the growing attribute set on each new attribute node or continuation line, so each added distinct name forces the whole accumulated set to be walked again. In affected applications that register AttributesExtension, this reduces throughput and can prevent legitimate requests from completing.

Workarounds

• Do not register AttributesExtension when converting untrusted Markdown; this removes the vulnerable attribute-processing paths entirely.
• If you must keep AttributesExtension enabled, impose a strict maximum input length before conversion so a crafted long run of distinct attributes cannot drive quadratic CPU usage.

• GitHub Commit 2.10.0
• Maintainer's Advisory