Technical impact
This vulnerability permits an attacker to supply Markdown content containing a large number of uniquely named attributes. The AttributesExtension processes these attributes in a quadratic time fashion, causing significant CPU consumption and preventing normal requests from completing. The identified weakness (CWE‑407) reflects the failure to limit processing time, and the resulting denial of service can affect application availability for legitimate users.
Affected Systems
Thephpleague commonmark releases from version 1.5.0 up to, but not including, 2.10.0 are impacted. Any installation of the library within this range, regardless of environment, may be exploited if the AttributesExtension is enabled.
Risk and Exploitability
The CVSS score of 8.7 indicates a high severity impact with potential for complete disruption of services. The EPSS score is currently unavailable, but the lack of an immediate fix condition means an attacker could craft payloads that trigger the quadratic merge logic. Because the vulnerability is tied directly to user-supplied Markdown, the attack vector is inferred to be through HTTP requests or other interfaces that accept Markdown. No known publicly disclosed exploits exist yet; however, the high severity combined with the ability to cause resource exhaustion warrants prompt remediation. The vulnerability is not listed in CISA KEV, but its potential to degrade service quality remains significant.
