CWE-407
Allowed-with-ReviewInefficient Algorithmic Complexity
Abstraction: Class · Status: Incomplete
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
320 vulnerabilities reference this CWE, most recent first.
GHSA-HF3R-VMRV-7W29
Vulnerability from github – Published: 2024-01-03 18:30 – Updated: 2024-01-03 22:28Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6r92-cgxc-r5fg. This link is maintained to preserve external references.
Original Description
PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "PeterO.Cbor"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-03T21:06:15Z",
"nvd_published_at": "2024-01-03T16:15:09Z",
"severity": "HIGH"
},
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6r92-cgxc-r5fg. This link is maintained to preserve external references.\n\n### Original Description\nPeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \nservice vulnerability. An attacker may trigger the denial of service \ncondition by providing crafted data to the DecodeFromBytes or other \ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \nlibrary, an unauthenticated and remote attacker may be able to cause the\n denial of service condition.\n",
"id": "GHSA-hf3r-vmrv-7w29",
"modified": "2024-01-03T22:28:05Z",
"published": "2024-01-03T18:30:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21909"
},
{
"type": "WEB",
"url": "https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-6r92-cgxc-r5fg"
},
{
"type": "WEB",
"url": "https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1"
},
{
"type": "WEB",
"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Duplicate Advisory: Denial of service in CBOR library",
"withdrawn": "2024-01-03T21:06:15Z"
}
GHSA-HFJ8-63C8-RMFW
Vulnerability from github – Published: 2024-01-19 21:30 – Updated: 2026-01-22 20:53Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-36p8-mvp6-cv38. This link is maintained to preserve external references.
Original Description
Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.upokecenter:cbor"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-23T14:36:37Z",
"nvd_published_at": "2024-01-19T21:15:10Z",
"severity": "HIGH"
},
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-36p8-mvp6-cv38. This link is maintained to preserve external references.\n\n## Original Description\nInefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application\u0027s use of this library, this may be a remote attacker.",
"id": "GHSA-hfj8-63c8-rmfw",
"modified": "2026-01-22T20:53:05Z",
"published": "2024-01-19T21:30:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23684"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-fj2w-wfgv-mwq6"
},
{
"type": "PACKAGE",
"url": "https://github.com/peteroupc/CBOR-Java"
},
{
"type": "WEB",
"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: Inefficient Algorithmic Complexity in com.upokecenter:cbor",
"withdrawn": "2026-01-22T20:53:05Z"
}
GHSA-HFQX-732W-XRRW
Vulnerability from github – Published: 2025-12-03 21:31 – Updated: 2026-01-26 15:30When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
{
"affected": [],
"aliases": [
"CVE-2025-12084"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-03T19:15:55Z",
"severity": "MODERATE"
},
"details": "When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.",
"id": "GHSA-hfqx-732w-xrrw",
"modified": "2026-01-26T15:30:31Z",
"published": "2025-12-03T21:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12084"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/issues/142145"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/pull/142146"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HQQC-JR88-P6X2
Vulnerability from github – Published: 2025-03-31 21:47 – Updated: 2025-03-31 21:47An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).
See https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.netty.incubator:netty-incubator-codec-quic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.71.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-29908"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-31T21:47:20Z",
"nvd_published_at": "2025-03-31T19:15:40Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).\n\nSee https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory",
"id": "GHSA-hqqc-jr88-p6x2",
"modified": "2025-03-31T21:47:21Z",
"published": "2025-03-31T21:47:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/netty/netty-incubator-codec-quic/security/advisories/GHSA-hqqc-jr88-p6x2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29908"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty-incubator-codec-quic/commit/e059bd9b78723f8b035e0c547e42ce263f03461c"
},
{
"type": "WEB",
"url": "https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory"
},
{
"type": "PACKAGE",
"url": "https://github.com/netty/netty-incubator-codec-quic"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Netty QUIC hash collision DoS attack"
}
GHSA-HXRJ-XXG4-W3QP
Vulnerability from github – Published: 2026-09-07 15:33 – Updated: 2026-09-07 15:33league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
{
"affected": [],
"aliases": [
"CVE-2026-86430"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-07T13:20:42Z",
"severity": "HIGH"
},
"details": "league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.",
"id": "GHSA-hxrj-xxg4-w3qp",
"modified": "2026-09-07T15:33:53Z",
"published": "2026-09-07T15:33:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-j8pm-gj4c-rq4x"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86430"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/league-commonmark-before-2.9.1-denial-of-service-via-parsing"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J3QR-8F3V-FGJJ
Vulnerability from github – Published: 2025-02-10 18:30 – Updated: 2026-06-30 03:35A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.
{
"affected": [],
"aliases": [
"CVE-2024-12133"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-10T16:15:37Z",
"severity": "MODERATE"
},
"details": "A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.",
"id": "GHSA-j3qr-8f3v-fgjj",
"modified": "2026-06-30T03:35:19Z",
"published": "2025-02-10T18:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12133"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20250523-0003"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00025.html"
},
{
"type": "WEB",
"url": "https://gitlab.com/gnutls/libtasn1/-/issues/52"
},
{
"type": "WEB",
"url": "https://gitlab.com/gnutls/libtasn1/-/blob/master/doc/security/CVE-2024-12133.md"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-202008.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344611"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-12133"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33125"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30850"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30849"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:8021"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7077"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4049"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:17347"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/02/06/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-J8PM-GJ4C-RQ4X
Vulnerability from github – Published: 2026-09-01 20:17 – Updated: 2026-09-01 20:17Impact
Affected versions of league/commonmark perform super-linear work on three independent parsing paths, all of which are reachable on a stock new CommonMarkConverter() with default configuration and no extensions registered. Each trigger fits on a single line of input, so no complex Markdown structure is required.
The three paths were introduced at different times. This advisory's version range is their union; the individual ranges are:
| Path | Affected from | Affected through |
|---|---|---|
| 1. Fenced code block detection | 0.6.0 |
2.9.0 |
| 2. Reference link label lookup | 0.6.0 |
2.9.0 |
3. Emphasis / strikethrough delimiters (*, _, ~) |
2.6.0 |
2.9.0 |
3. Highlight delimiters (=) |
2.9.0 |
2.9.0 |
1. Fenced code block detection — quadratic, affected from 0.6.0.
FencedCodeStartParser matches the following pattern:
/^[ \t]*(?:`{3,}(?!.*`)|~{3,})/
The lookahead enforces the CommonMark rule that a backtick fence's info string may not itself contain a backtick, but neither the lookahead nor the backtick run it guards is atomic or possessive. On a line consisting of a long backtick run, filler text, and a single trailing backtick, the quantifier gives back one character at a time and re-runs the lookahead across the remainder of the line on every candidate fence length.
A 320 KB single line takes roughly 27 seconds to convert. The identical payload with one x character prefixed — which fails the parser's own leading-character guard — takes 0.011 seconds. preg_last_error() returns 0 at every input size tested, including runs of 160,000 characters, so PCRE never reaches pcre.backtrack_limit and this is sustained CPU consumption rather than an early bail-out.
2. Reference link label lookup — effectively quadratic, affected from 0.6.0.
When a shortcut or collapsed reference link is attempted, CloseBracketParser::tryParseReference() copies the entire span between the brackets and passes it to ReferenceMap::get(), which normalizes the label — up to four full passes over its length (trim, preg_replace, mb_check_encoding, and strtolower, or mb_convert_case on the non-ASCII path). Nested brackets produce one such lookup per closing bracket, each on a span two characters longer than the last.
In 2.x the normalization sits behind an early return for an empty reference map, so a single 8-byte reference definition anywhere in the document ([x]: y) is enough to unlock the path. At n = 64,000 nested brackets the same input takes 22.0 seconds with that line present versus 0.59 seconds without it. A single non-ASCII character inside the brackets forces the mb_convert_case branch, costing roughly 2.5x more again.
3. Emphasis, strikethrough, and highlight delimiter processing — super-linear, affected from 2.6.0.
DelimiterStack::processDelimiters() remains linear only because of the openersBottom memo, which bounds the backward opener scan — an argument that holds only if the memo's key space is O(1). EmphasisDelimiterProcessor::getCacheKey(), and the equivalents in StrikethroughDelimiterProcessor and MarkDelimiterProcessor, embed the closer's raw current run length in the key, leaving that space unbounded. An attacker spends O(n) bytes minting a growing number of distinct run lengths; each distinct length is a fresh key whose recorded bound starts at zero, forcing a full backward re-scan of the entire pile of openers.
The resulting work grows as roughly n^1.5. This is sub-quadratic, but the amplification over linear growth itself scales with input size, so it worsens as inputs grow: 800 KB of ordinary asterisks, letters, and spaces costs roughly 27 seconds on a stock converter.
This path is a regression introduced in 2.6.0. Before that release the cache key was the bare delimiter character — a bounded key space that amortized correctly. * and _ are affected on any default configuration from 2.6.0 onward. ~ (StrikethroughExtension, included in GithubFlavoredMarkdownConverter and GithubFlavoredMarkdownExtension) is affected from 2.6.0. = (HighlightExtension) is affected only from 2.9.0, when MarkDelimiterProcessor was declared cacheable.
Overall impact. An unauthenticated attacker who can submit Markdown for conversion can use a comparatively small request to consume disproportionate CPU time. Repeated or concurrent requests can occupy all available PHP workers and prevent legitimate requests from completing. The impact is limited to availability: no data is disclosed, rendered output is unchanged, and no rendering restriction is bypassed. Applications that process only trusted Markdown are not remotely exploitable.
Settings such as html_input, allow_unsafe_links, and max_nesting_level do not mitigate any of these, because the expensive work occurs during parsing, before rendering. max_delimiters_per_line bounds the third path only, and does so lossily — it silently discards emphasis once the cap is exhausted.
Patches
The issues are patched in 2.9.1 and later:
- The fenced code block quantifier is now possessive, which is behavior-identical here: any character given back moves a backtick into the lookahead's scan range, so every retry was guaranteed to fail regardless.
- Reference link lookups now apply the CommonMark 999-character link label limit before copying and normalizing the label, matching the limit already enforced when parsing reference definitions. Because a definition can never exceed that length, an over-length lookup label cannot match one directly. One edge case does change: a label longer than 999 characters that collapses to a shorter match once whitespace is normalized — for example
[afollowed by 998 spaces andb]against a[a b]: /urldefinition — previously rendered as a link and now renders literally. This follows cmark, which applies its own label-length cap before normalizing (cmark_reference_lookup()), and matches how this library has always handled the equivalent[text][label]form viaLinkParserHelper::parseLinkLabel(). commonmark.js normalizes first and still resolves such labels. - Delimiter processor cache keys now clamp the run length to the coarsest bucket that can change behavior —
min(length, 2)for emphasis,min(length, 3)for strikethrough and highlight — restoring a bounded key space while preserving byte-identical output.
Versions from 0.6.0 through 2.9.0 are affected by at least one of these paths; see the table above for which paths apply to which releases. The 0.x and 1.x release lines are no longer supported, so their users must upgrade to 2.9.1 or later.
Workarounds
If you cannot upgrade immediately, enforce a maximum length for individual lines before passing input to the converter, in addition to a total request-size limit. A per-line limit matters because every trigger described above fits within a single line. Because the cost grows super-linearly, the cap must be genuinely small to bound worst-case CPU.
Setting max_delimiters_per_line reduces exposure to the delimiter path only, and does so by silently dropping emphasis from the rendered output. It has no effect on the fenced code or reference link paths.
Restricting conversion to trusted users, applying strict execution-time limits, rate-limiting requests, and limiting concurrent conversions all reduce exposure, but none is a complete substitute for upgrading.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "league/commonmark"
},
"ranges": [
{
"events": [
{
"introduced": "0.6.0"
},
{
"fixed": "2.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1050",
"CWE-1333",
"CWE-407"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-01T20:17:59Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\nAffected versions of `league/commonmark` perform super-linear work on three independent parsing paths, all of which are reachable on a stock `new CommonMarkConverter()` with default configuration and no extensions registered. Each trigger fits on a single line of input, so no complex Markdown structure is required.\n\nThe three paths were introduced at different times. This advisory\u0027s version range is their union; the individual ranges are:\n\n| Path | Affected from | Affected through |\n|---|---|---|\n| 1. Fenced code block detection | `0.6.0` | `2.9.0` |\n| 2. Reference link label lookup | `0.6.0` | `2.9.0` |\n| 3. Emphasis / strikethrough delimiters (`*`, `_`, `~`) | `2.6.0` | `2.9.0` |\n| 3. Highlight delimiters (`=`) | `2.9.0` | `2.9.0` |\n\n**1. Fenced code block detection \u2014 quadratic, affected from 0.6.0.**\n\n`FencedCodeStartParser` matches the following pattern:\n\n```\n/^[ \\t]*(?:`{3,}(?!.*`)|~{3,})/\n```\n\nThe lookahead enforces the CommonMark rule that a backtick fence\u0027s info string may not itself contain a backtick, but neither the lookahead nor the backtick run it guards is atomic or possessive. On a line consisting of a long backtick run, filler text, and a single trailing backtick, the quantifier gives back one character at a time and re-runs the lookahead across the remainder of the line on every candidate fence length.\n\nA 320 KB single line takes roughly 27 seconds to convert. The identical payload with one `x` character prefixed \u2014 which fails the parser\u0027s own leading-character guard \u2014 takes 0.011 seconds. `preg_last_error()` returns `0` at every input size tested, including runs of 160,000 characters, so PCRE never reaches `pcre.backtrack_limit` and this is sustained CPU consumption rather than an early bail-out.\n\n**2. Reference link label lookup \u2014 effectively quadratic, affected from 0.6.0.**\n\nWhen a shortcut or collapsed reference link is attempted, `CloseBracketParser::tryParseReference()` copies the entire span between the brackets and passes it to `ReferenceMap::get()`, which normalizes the label \u2014 up to four full passes over its length (`trim`, `preg_replace`, `mb_check_encoding`, and `strtolower`, or `mb_convert_case` on the non-ASCII path). Nested brackets produce one such lookup per closing bracket, each on a span two characters longer than the last.\n\nIn 2.x the normalization sits behind an early return for an empty reference map, so a single 8-byte reference definition anywhere in the document (`[x]: y`) is enough to unlock the path. At n = 64,000 nested brackets the same input takes 22.0 seconds with that line present versus 0.59 seconds without it. A single non-ASCII character inside the brackets forces the `mb_convert_case` branch, costing roughly 2.5x more again.\n\n**3. Emphasis, strikethrough, and highlight delimiter processing \u2014 super-linear, affected from 2.6.0.**\n\n`DelimiterStack::processDelimiters()` remains linear only because of the `openersBottom` memo, which bounds the backward opener scan \u2014 an argument that holds only if the memo\u0027s key space is O(1). `EmphasisDelimiterProcessor::getCacheKey()`, and the equivalents in `StrikethroughDelimiterProcessor` and `MarkDelimiterProcessor`, embed the closer\u0027s raw current run length in the key, leaving that space unbounded. An attacker spends O(n) bytes minting a growing number of distinct run lengths; each distinct length is a fresh key whose recorded bound starts at zero, forcing a full backward re-scan of the entire pile of openers.\n\nThe resulting work grows as roughly n^1.5. This is sub-quadratic, but the amplification over linear growth itself scales with input size, so it worsens as inputs grow: 800 KB of ordinary asterisks, letters, and spaces costs roughly 27 seconds on a stock converter.\n\nThis path is a regression introduced in **2.6.0**. Before that release the cache key was the bare delimiter character \u2014 a bounded key space that amortized correctly. `*` and `_` are affected on any default configuration from 2.6.0 onward. `~` (`StrikethroughExtension`, included in `GithubFlavoredMarkdownConverter` and `GithubFlavoredMarkdownExtension`) is affected from 2.6.0. `=` (`HighlightExtension`) is affected only from **2.9.0**, when `MarkDelimiterProcessor` was declared cacheable.\n\n**Overall impact.** An unauthenticated attacker who can submit Markdown for conversion can use a comparatively small request to consume disproportionate CPU time. Repeated or concurrent requests can occupy all available PHP workers and prevent legitimate requests from completing. The impact is limited to availability: no data is disclosed, rendered output is unchanged, and no rendering restriction is bypassed. Applications that process only trusted Markdown are not remotely exploitable.\n\nSettings such as `html_input`, `allow_unsafe_links`, and `max_nesting_level` do not mitigate any of these, because the expensive work occurs during parsing, before rendering. `max_delimiters_per_line` bounds the third path only, and does so lossily \u2014 it silently discards emphasis once the cap is exhausted.\n\n### Patches\n\nThe issues are patched in `2.9.1` and later:\n\n- The fenced code block quantifier is now possessive, which is behavior-identical here: any character given back moves a backtick into the lookahead\u0027s scan range, so every retry was guaranteed to fail regardless.\n- Reference link *lookups* now apply the CommonMark 999-character link label limit before copying and normalizing the label, matching the limit already enforced when parsing reference *definitions*. Because a definition can never exceed that length, an over-length lookup label cannot match one directly. One edge case does change: a label longer than 999 characters that *collapses* to a shorter match once whitespace is normalized \u2014 for example `[a` followed by 998 spaces and `b]` against a `[a b]: /url` definition \u2014 previously rendered as a link and now renders literally. This follows cmark, which applies its own label-length cap before normalizing (`cmark_reference_lookup()`), and matches how this library has always handled the equivalent `[text][label]` form via `LinkParserHelper::parseLinkLabel()`. commonmark.js normalizes first and still resolves such labels.\n- Delimiter processor cache keys now clamp the run length to the coarsest bucket that can change behavior \u2014 `min(length, 2)` for emphasis, `min(length, 3)` for strikethrough and highlight \u2014 restoring a bounded key space while preserving byte-identical output.\n\nVersions from `0.6.0` through `2.9.0` are affected by at least one of these paths; see the table above for which paths apply to which releases. The 0.x and 1.x release lines are no longer supported, so their users must upgrade to `2.9.1` or later.\n\n### Workarounds\n\nIf you cannot upgrade immediately, enforce a **maximum length for individual lines** before passing input to the converter, in addition to a total request-size limit. A per-line limit matters because every trigger described above fits within a single line. Because the cost grows super-linearly, the cap must be genuinely small to bound worst-case CPU.\n\nSetting `max_delimiters_per_line` reduces exposure to the delimiter path only, and does so by silently dropping emphasis from the rendered output. It has no effect on the fenced code or reference link paths.\n\nRestricting conversion to trusted users, applying strict execution-time limits, rate-limiting requests, and limiting concurrent conversions all reduce exposure, but none is a complete substitute for upgrading.",
"id": "GHSA-j8pm-gj4c-rq4x",
"modified": "2026-09-01T20:17:59Z",
"published": "2026-09-01T20:17:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-j8pm-gj4c-rq4x"
},
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/commit/0768217751fbfaeb8d76762f6944e9af7114295e"
},
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/commit/d9375fadc308a63a02950a68d822417a6e4c33b2"
},
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/commit/e0036ef031fd36ec1c3c82db8743fc928b5271c8"
},
{
"type": "PACKAGE",
"url": "https://github.com/thephpleague/commonmark"
},
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/releases/tag/2.9.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters"
}
GHSA-JCMH-CHHQ-RH2X
Vulnerability from github – Published: 2026-09-07 15:33 – Updated: 2026-09-07 15:33league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.
{
"affected": [],
"aliases": [
"CVE-2026-86434"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-07T13:20:42Z",
"severity": "HIGH"
},
"details": "league/commonmark versions \u003e= 2.0.0 and \u003c 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.",
"id": "GHSA-jcmh-chhq-rh2x",
"modified": "2026-09-07T15:33:53Z",
"published": "2026-09-07T15:33:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-mh25-x5hq-wrqp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86434"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/commonmark-2.0.0-through-2.8.3-denial-of-service-via-slug-collision"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JFM3-95JQ-Q3RF
Vulnerability from github – Published: 2026-08-06 20:40 – Updated: 2026-08-06 20:42Impact
The Footnote extension records one backref per footnote reference and then appends the entire backref list for every footnote definition block in the document, without ever de-duplicating or removing repeated definitions of the same label (GatherFootnotesListener, populated by NumberFootnotesListener). A document that references a single label N times and also supplies N duplicate [^a]: definitions of that label therefore produces N × N FootnoteBackref nodes, so output size, parse time, and peak memory are all O(N²).
Reaching the vulnerable path requires FootnoteExtension to be registered on the Environment. This is opt-in, but is a commonly enabled GFM-style feature; no other non-default configuration is required. An unauthenticated attacker can expand a ~10 KB request into a ~62 MB HTML response, ~3 s of CPU, and ~440 MB of peak memory — enough to OOM-kill a default 128 MB PHP worker and deny service. Availability impact only; no confidentiality or integrity effect. The Footnote extension was introduced in 1.5.0 (May 2020) with this backref logic present from the first commit, so all releases from 1.5.0 onward (including every 2.x through 2.8.x) are affected.
Workarounds
There is no library-level option to cap the number of footnotes, references, or definitions, so no configuration switch prevents the amplification. Integrators who cannot upgrade should:
- Disable the Footnote extension for untrusted input, or
- Enforce a strict input-size limit before conversion — but note this is a weak control here, since the ~10 KB payload that already triggers the 62 MB / ~440 MB blowup is well within typical request-body limits, so any cap must be aggressively small to help.
Upgrading to the patched release is the recommended remediation.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "league/commonmark"
},
"ranges": [
{
"events": [
{
"introduced": "1.5.0"
},
{
"fixed": "2.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-06T20:40:53Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\nThe Footnote extension records one backref per footnote *reference* and then appends the **entire** backref list for **every** footnote *definition* block in the document, without ever de-duplicating or removing repeated definitions of the same label (`GatherFootnotesListener`, populated by `NumberFootnotesListener`). A document that references a single label N times and also supplies N duplicate `[^a]:` definitions of that label therefore produces **N \u00d7 N** `FootnoteBackref` nodes, so output size, parse time, and peak memory are all **O(N\u00b2)**.\n\nReaching the vulnerable path requires `FootnoteExtension` to be registered on the `Environment`. This is opt-in, but is a commonly enabled GFM-style feature; no other non-default configuration is required. An unauthenticated attacker can expand a **~10 KB** request into a **~62 MB** HTML response, **~3 s** of CPU, and **~440 MB** of peak memory \u2014 enough to OOM-kill a default 128 MB PHP worker and deny service. Availability impact only; no confidentiality or integrity effect. **The Footnote extension was introduced in 1.5.0 (May 2020) with this backref logic present from the first commit, so all releases from 1.5.0 onward (including every 2.x through 2.8.x) are affected.**\n\n### Workarounds\n\nThere is no library-level option to cap the number of footnotes, references, or definitions, so no configuration switch prevents the amplification. Integrators who cannot upgrade should:\n\n- **Disable the Footnote extension** for untrusted input, or\n- **Enforce a strict input-size limit before conversion** \u2014 but note this is a weak control here, since the ~10 KB payload that already triggers the 62 MB / ~440 MB blowup is well within typical request-body limits, so any cap must be aggressively small to help.\n\nUpgrading to the patched release is the recommended remediation.",
"id": "GHSA-jfm3-95jq-q3rf",
"modified": "2026-08-06T20:42:11Z",
"published": "2026-08-06T20:40:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-jfm3-95jq-q3rf"
},
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/commit/66028124a17ba193da7b11cc3dfda92df21bfbf4"
},
{
"type": "PACKAGE",
"url": "https://github.com/thephpleague/commonmark"
},
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/releases/tag/2.9.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "league/commonmark: Denial of service via duplicate footnote definitions"
}
GHSA-JG6J-874M-WGJJ
Vulnerability from github – Published: 2026-06-03 18:33 – Updated: 2026-08-11 03:31unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
{
"affected": [],
"aliases": [
"CVE-2026-3276"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-03T16:16:29Z",
"severity": "MODERATE"
},
"details": "unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms.",
"id": "GHSA-jg6j-874m-wgjj",
"modified": "2026-08-11T03:31:50Z",
"published": "2026-06-03T18:33:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3276"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/issues/149079"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/pull/149080"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c"
},
{
"type": "WEB",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/06/03/15"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.