CyberRota Analysis
AI-GeneratedVersions of league/commonmark from 2.0.0 to 2.8.4 are vulnerable to a denial of service attack due to inefficient handling of slug collisions in the UniqueSlugNormalizer::normalize() function, leading to O(K^2) time complexity when multiple headings collapse to the same base slug. This vulnerability can be exploited by unauthenticated attackers to consume excessive CPU resources, resulting in service disruption. Organizations using affected versions, particularly those utilizing HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension, should prioritize patching to version 2.9.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.