The Attributes extension in league/commonmark (introduced in version 1.5.0) uses an algorithm in AttributesListener::findTargetAndDirection() that resolves each attribute node's target by scanning outward through sibling nodes. For a run of N adjacent inline attribute blocks at the start of a block, each node scans the entire sibling list to the far right, resulting in a quadratic time complexity (Θ(N²)) during parsing. This behavior is unconditional and not mitigated by configuration options such as the attributes/allow allow-list or other hardening features. An attacker can submit approximately 32 KB of input (e.g., repeated '{#a}' 8,000 times) to cause parsing to take over 5 seconds, leading to a denial of service via high CPU consumption. The vulnerability affects all releases from 1.5.0 through versions before 2.9.0. No known exploits are reported in the wild. Mitigation includes disabling the Attributes extension for untrusted input or imposing strict input length limits. Upgrading to a fixed release is recommended.

This vulnerability allows an unauthenticated attacker to cause a denial of service by submitting specially crafted input that triggers a quadratic parsing time in the Attributes extension, resulting in high CPU usage and degraded availability of the service using league/commonmark. There is no impact on confidentiality or integrity.

A patch is available for this vulnerability. Users are advised to upgrade to a fixed version of league/commonmark at or beyond 2.9.0. If upgrading is not immediately possible, mitigations include disabling the Attributes extension for untrusted input or enforcing strict maximum input length limits to reduce exposure to the quadratic parsing behavior.