A denial of service vulnerability exists in league/commonmark versions 2.0.0 through 2.8.x due to a quadratic algorithmic complexity in the UniqueSlugNormalizer::normalize() function. This function restarts its search for unique slug suffixes from 1 on every collision, causing O(K²) CPU cost for K colliding slugs. The issue affects processing of headings and footnotes when certain extensions are enabled, allowing an attacker to cause significant CPU consumption and service disruption without authentication. Workarounds include disabling slug uniqueness or affected extensions, but upgrading to a patched release is recommended.