The UniqueSlugNormalizer in league/commonmark (introduced in 2.0.0) attempts to ensure unique slugs by searching for unused numeric suffixes starting from 1 on each collision, resulting in quadratic time complexity (O(K²)) when many headings collapse to the same base slug. This can be trivially triggered by attacker-controlled Markdown containing many identical or empty headings, causing denial of service by excessive CPU usage. The vulnerability is triggered when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension are used, as they normalize headings or footnotes with this slug normalizer. No authentication is required. Versions from 2.0.0 up to but not including 2.9.0 are affected. Workarounds include disabling slug uniqueness or the affected extensions, or limiting document size, but the recommended fix is upgrading to a patched version that removes the quadratic behavior while preserving functionality.

An attacker can cause denial of service by submitting Markdown documents with many colliding headings or footnotes that cause the slug normalization process to consume excessive CPU resources. This leads to service unavailability or degraded performance. There is no impact on confidentiality or integrity. No authentication is required to trigger the vulnerability.

A patch is available that removes the quadratic behavior while maintaining unique slug IDs and output correctness. Users should upgrade to a patched release at or beyond version 2.9.0. As temporary workarounds, integrators can disable slug uniqueness by setting slug_normalizer/unique to false, disable the HeadingPermalinkExtension and TableOfContentsExtension (which depends on it), and FootnoteExtension for untrusted Markdown, or limit document size and heading count upstream to avoid triggering the quadratic cost. These workarounds trade off functionality or correctness and are not recommended long-term.