commonmark implements a footnote extension that is supposed to deduplicate identical footnote definitions. In versions 1.5.0 through 2.8.3 the implementation fails to perform this deduplication, allowing a crafted document to contain many duplicate definitions that, when processed, grow quadratically in size and consume substantial memory and CPU resources. The result is that a server or process parsing such a document can become overwhelmed, stalling or crashing and denying service to legitimate users. The weakness is classified as CWE‑407: Unchecked Loop Condition. The containment is limited to the user of the commonmark library; an attacker must be able to supply or influence the parsed document.

Thephpleague commonmark library, versions 1.5.0 up to but not including 2.8.4. Systems that incorporate any of these library versions and parse untrusted Markdown content are vulnerable.

The CVSS score of 8.7 places this vulnerability in the High severity range. EPSS is currently not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, which suggests there is no publicly known exploit, though the impact potential remains high. Based on the description, the likely attack vector is delivering a malicious Markdown document with duplicate footnote definitions to any service that parses it with the vulnerable commonmark library. The prerequisites are the presence of the vulnerable library and the processing of untrusted content. Without additional mitigations, exploitation can lead to resource exhaustion and service denial.