Inefficient Algorithmic Complexity Affecting league/commonmark package, versions >=0.6.0, <2.9.1

league/commonmark is a PHP-based Markdown parser which supports the full CommonMark spec. It is based on the CommonMark JS reference implementation.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity due to quadratic reference link label lookup in CloseBracketParser and ReferenceMap when resolving shortcut and collapsed reference links in the CommonMark parser. An attacker can exhaust CPU by sending Markdown with deeply nested brackets plus a single reference definition, causing each closing bracket to normalize and compare an increasingly long label span. This affects applications that convert untrusted Markdown with the default CommonMarkConverter; the result is sustained CPU consumption that can stall PHP workers and delay or prevent legitimate requests from completing.

Workarounds

• Enforce a maximum length for individual lines before passing Markdown to the converter, because each trigger fits on a single line and a genuinely small per-line cap bounds the worst-case CPU cost from deeply nested reference-link input.
• Restrict Markdown conversion to trusted users only, so untrusted attackers cannot submit crafted reference-link payloads that consume disproportionate CPU time.
• Apply strict execution-time limits and rate-limit conversion requests, which reduces the impact of repeated expensive parses and limits how long a single crafted request can tie up a PHP worker.

• GitHub Commit 2.9.1
• Maintainer's Advisory