The league/commonmark library's Footnote extension records one backreference per footnote reference and appends the entire backreference list for every footnote definition block without removing duplicates. This leads to an O(N²) increase in output size, parse time, and memory usage when a document contains N references and N duplicate definitions of the same footnote label. The vulnerability affects all versions from 1.5.0 (when the Footnote extension was introduced) through all 2.x releases up to 2.8.x. An unauthenticated attacker can cause a denial of service by submitting a crafted document that triggers excessive resource consumption, potentially causing out-of-memory termination of PHP workers. The vulnerability requires the Footnote extension to be enabled, which is opt-in but commonly used for GitHub-Flavored Markdown style features. No confidentiality or integrity impact is present.

This vulnerability causes a denial of service by consuming excessive CPU time (~3 seconds), memory (~440 MB peak), and producing very large HTML output (~62 MB) from a small input (~10 KB). This can lead to out-of-memory kills of PHP workers with default memory limits (e.g., 128 MB), resulting in service unavailability. There is no impact on confidentiality or integrity.

A patch is available for this vulnerability and upgrading to a fixed release (version 2.9.0 or later) is the recommended remediation. If upgrading is not immediately possible, integrators should disable the Footnote extension for untrusted input or enforce strict input size limits before processing, though input size limits must be very small to be effective. The vendor advisory confirms a fix is available.