Thephpleague commonmark library, used for parsing and rendering CommonMark Markdown in PHP, suffers from an inefficient algorithmic complexity vulnerability (CWE-407) in versions >=0.6.0 and <2.9.0. The parser's handling of certain Markdown lines involves repeated rescanning of increasing portions of a line to translate character to byte positions. Additionally, the Autolink extension copies and validates the remaining line at every URL-like prefix, compounding the inefficiency. This results in quadratic time complexity, allowing an attacker who can submit Markdown for conversion to cause excessive CPU consumption. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only. The issue is resolved in version 2.9.0.

An attacker able to submit crafted Markdown input to the vulnerable commonmark parser can cause excessive CPU usage due to quadratic time complexity in parsing. This can lead to denial of service conditions by exhausting server processing resources. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Upgrade to version 2.9.0 or later of thephpleague commonmark library where this inefficiency is fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed fixed in 2.9.0.