{"uuid": "710e5153-b867-44db-9fdd-bd4b2b5ae65b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-JFM3-95JQ-Q3RF", "type": "seen", "source": "https://gist.github.com/alon710/083e0c15dfeb9a6ae7deb8244b73b528", "content": "# GHSA-JFM3-95JQ-Q3RF: GHSA-jfm3-95jq-q3rf: Algorithmic Complexity Denial of Service and Path-Delimiter Injection in league/commonmark Footnote Extension\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/GHSA-JFM3-95JQ-Q3RF\n\n## Summary\nAn architectural flaw in the Footnote extension of league/commonmark allows unauthenticated remote attackers to trigger severe denial of service conditions through algorithmic complexity exploitation (O(N^2) CPU and memory exhaustion) and path-delimiter injection leading to unexpected application-level crashes.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust server memory and CPU resources or crash the PHP worker process by submitting crafted footnote definitions containing duplicate labels or path-delimiting characters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407 (Inefficient Algorithmic Complexity)\n- **Attack Vector**: Network (Remote, Unauthenticated)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Impact Type**: Denial of Service (OOM and CPU Exhaustion)\n- **Exploit Status**: Proof of Concept available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- league/commonmark (Composer package, PHP)\n- **league/commonmark**: >= 1.5.0, < 2.9.0 (Fixed in: `2.9.0`)\n\n## Mitigation\n\n- Upgrade to league/commonmark version 2.9.0 or higher.\n- Disable the FootnoteExtension if processing untrusted input.\n- Sanitize or reject footnote labels containing dot (.) or slash (/) characters.\n\n**Remediation Steps:**\n1. Run 'composer update league/commonmark' to update package dependencies.\n2. Verify the installed version is 2.9.0 or later using 'composer show league/commonmark'.\n3. Search the codebase for 'new FootnoteExtension()' to verify where footnotes are enabled.\n\n## References\n\n- [GitHub Advisory Database Entry](https://github.com/advisories/GHSA-JFM3-95JQ-Q3RF)\n- [Vendor Security Advisory](https://github.com/thephpleague/commonmark/security/advisories/GHSA-jfm3-95jq-q3rf)\n- [Official Patch Commit](https://github.com/thephpleague/commonmark/commit/66028124a17ba193da7b11cc3dfda92df21bfbf4)\n- [Release v2.9.0 Changelog](https://github.com/thephpleague/commonmark/releases/tag/2.9.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-JFM3-95JQ-Q3RF) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T14:32:36.667354Z"}