League CommonMark, a PHP library for parsing Markdown, contains a quadratic-time complexity flaw that can be triggered by specially crafted lines. The flaw causes the parser to repeatedly rescan growing portions of a line, consuming disproportionate CPU time for a small request. The result is a denial of service, allowing an attacker to overwhelm a server or application that uses the library.

The vulnerability affects versions of thephpleague CommonMark from 0.6.0 up through 2.8.9. The fix was introduced in revision 2.9.0; any deployment using the library within that range is potentially impacted.

The CVSS score of 7.5 indicates moderate to high severity, and the presence of the flaw in public code means exploitation is likely if an attacker can submit Markdown for conversion—even without authentication. Although no EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, the attack vector is inferred to be remote via web interfaces or APIs that accept Markdown input. The flaw can lead to high CPU usage and service disruption.