A denial of service vulnerability exists in league/commonmark when the Attributes extension is enabled. The vulnerability arises from a quadratic time complexity in resolving adjacent inline attribute blocks at the start of a block, causing excessive CPU usage. An unauthenticated attacker can exploit this by submitting crafted input that triggers long processing times, impacting availability. This affects all versions from 1.5.0 up to but not including 2.9.0. A patch is available to address this issue.