Denial of Service Risk in league/commonmark Due to Quadratic Complexity Bugs
Summary
GHSA-c2pc-g5qf-rfrf: league/commonmark's quadratic complexity bugs may lead to a denial of service. Affects league/commonmark versions < 2.6.0. Fixed in 2.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
league/commonmark is a popular PHP library used for parsing and rendering Markdown. It provides a robust set of features for handling Markdown syntax, making it a go-to choice for developers looking to integrate Markdown functionality into their applications. However, recent findings have revealed vulnerabilities related to its handling of certain Markdown inputs, which can lead to performance issues and potential denial of service attacks.
Vulnerability Detail
The vulnerability stems from several polynomial time complexity issues within league/commonmark. Malicious users can exploit these weaknesses by submitting specially crafted Markdown inputs designed to trigger the worst-case performance scenarios. This can result in unbounded resource exhaustion, effectively tying up CPU resources and PHP-FPM processes. As a consequence, legitimate users may experience service disruptions or complete denial of service. The vulnerabilities were identified in other Markdown parsers, indicating a broader issue within similar libraries.
How To Fix
Minimum fixed version
2.6.0
This is the first release that contains the fix.
composer require league/commonmark:2.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
-
0: Set low PHP configurations for memory_limit and max_execution_time to prevent excessive resource usage.
-
1: Implement rate-limiting or bot protection to mitigate the risk of simultaneous malicious requests.
-
2: Limit the size of inputs processed by the library, particularly the maximum length of each line.
-
3: Restrict the use of this library to trusted users only.
Conclusion
The vulnerabilities in league/commonmark pose a significant risk of denial of service due to quadratic complexity issues in processing Markdown inputs. Users are strongly encouraged to upgrade to the patched version 2.6.0 to mitigate these risks. For those unable to upgrade immediately, implementing the suggested workarounds can help reduce the likelihood of exploitation.
See every vulnerability recorded for league/commonmark →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The primary consequence is denial of service, where legitimate users may be unable to access the application due to resource exhaustion caused by malicious inputs.
Yes, you can implement workarounds such as setting low memory limits, using rate-limiting, and restricting input sizes.
If you experience issues after upgrading, check the library's documentation for any breaking changes or compatibility issues, and consider reaching out to the community for support.
References
Related vulnerabilities
Recent vulnerabilities recorded for league/commonmark.
