Thephpleague commonmark library, used for parsing and rendering CommonMark Markdown in PHP, contains an inefficient algorithmic complexity vulnerability (CWE-407) in versions >=0.6.0 and <2.9.0. Specially crafted Markdown lines cause the parser to repeatedly rescan growing portions of a line, leading to quadratic time complexity. Additionally, the Autolink extension exacerbates this by copying and validating the remaining line at every URL-like prefix. This allows an attacker who can submit Markdown for conversion to consume excessive CPU resources with relatively small input. The vulnerability is fixed in version 2.9.0.

An attacker able to submit Markdown content for parsing can cause the commonmark parser to consume disproportionate CPU time, potentially leading to denial of service by exhausting server resources. There is no impact on confidentiality or integrity reported.

Upgrade thephpleague commonmark to version 2.9.0 or later, where this inefficient algorithmic complexity issue is fixed. No other mitigations are indicated.