This vulnerability in league/commonmark allows attackers to trigger extremely expensive parsing algorithms by submitting specially crafted Markdown. The worst‑case quadratic complexity can exhaust CPU and process resources, resulting in a service outage. The weakness is a classic quadratic time attack, CWE‑407.

All versions of thephpleague:commonmark earlier than 2.6.0 are affected. The library is used in PHP applications that render Markdown. Any deployment that relies on this component without an updated version or mitigation is at risk.

The CVSS base score of 8.7 classifies it as high severity. EPSS is not available, so the exploitation likelihood is uncertain; however, the lack of a notification in KEV suggests no widespread exploitation yet. Attackers can abuse the flaw by sending potentially adversarial Markdown documents, and a multi‑request strategy can saturate a PHP‑FPM pool, causing denial of service. The vulnerability requires only the ability to process Markdown through the library, making it relatively easy to trigger from a compromised application or by unauthenticated input if the parser accepts external content.