A quadratic‑time algorithm within the Attributes extension of commonmark causes extreme CPU pressure during parsing of repeated attribute blocks. When an unauthenticated attacker submits about 32 KB of such data, parsing can exceed five seconds, draining server resources and potentially halting the application. The vulnerability allows an attacker to exhaust processing limits without any authentication or elevated privileges.

PHP applications using thephpleague/commonmark 1.5.0 through 2.8.3 are affected. Any version prior to 2.8.4 that includes the AttributesListener::findTargetAndDirection() implementation is susceptible. The issue impacts projects that parse user‑supplied markdown without restricting input size or disabling the Attributes extension.

With a CVSS score of 8.7, the vulnerability is rated high severity. No EPSS score is available, and it is not listed in CISA’s KEV catalog, suggesting no confirmed large‑scale exploitation yet. The likely attack vector is any public or internal interface that forwards markdown content to the CommonMark parser. Because the flaw is purely computational, successful exploitation merely requires supplying the crafted input; no additional prerequisites are needed.