CyberRota Analysis
AI-GeneratedCommonmark versions prior to 2.8.4 are vulnerable to a denial of service attack due to inefficient handling of attribute blocks in the Attributes extension, allowing unauthenticated attackers to exploit this by submitting specially crafted input. This can lead to significant resource exhaustion, causing delays in parsing that exceed 5 seconds. Organizations using affected Commonmark versions should prioritize patching to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources.