The PHP League commonmark library is vulnerable to a denial of service attack that allows unauthenticated attackers to exhaust CPU resources via maliciously crafted Markdown input.

This vulnerability, categorized as CWE-407, involves inefficient algorithmic complexity in the AttributesExtension: specifically, processing distinctly-named attributes causes quadratic-time merging that consumes excessive CPU. The attack is unauthenticated and requires no user interaction to trigger.

Successful exploitation leads to a denial of service, which can render web applications relying on this library unresponsive. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to availability, potentially disrupting critical business operations and degrading the performance of services that process user-generated Markdown content.

Immediate Action: Update the league/commonmark package to version 2.10.0 or later to incorporate the performance optimization fix.

Proactive Monitoring: Monitor server CPU utilization and error logs for spikes or process hangs associated with high-frequency Markdown parsing requests.

Compensating Controls: Implement rate limiting or request size restrictions on endpoints that accept Markdown input to mitigate the impact of potential resource exhaustion attempts.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing the league/commonmark library should prioritize the update to version 2.10.0 immediately. Because this vulnerability targets a fundamental processing function, it is critical to address this issue before it is weaponized in the wild to prevent potential application outages.