A high-severity denial of service vulnerability in the league/commonmark library allows unauthenticated remote attackers to exhaust system CPU resources through malicious Markdown payloads.

The library is susceptible to CWE-407: Inefficient Algorithmic Complexity within its SmartPunctExtension and AttributesExtension. An unauthenticated attacker can submit specifically crafted Markdown documents to force disproportionate CPU consumption, resulting in a denial of service.

Successful exploitation of this vulnerability can lead to significant service degradation or complete unavailability of applications relying on the library for Markdown processing. With a CVSS score of 7.5, the risk is high, particularly for public-facing web services that accept user-provided content, as the flaw allows an attacker to disrupt operations without requiring authentication or interaction.

Immediate Action: Update the league/commonmark package to version 2.9.1 or later via your dependency manager (e.g., Composer).

Proactive Monitoring: Monitor server CPU utilization metrics for sudden, sustained spikes that coincide with incoming web requests containing complex or repetitive Markdown syntax.

Compensating Controls: If immediate patching is not feasible, ensure that the SmartPunctExtension and AttributesExtension are disabled in the library configuration, as they are not enabled by default.

Public Exploit Available: Unknown.

Given the ease of exploitation and the potential for service disruption, organizations should prioritize updating the commonmark library to version 2.9.1. Ensure that development teams verify whether the vulnerable extensions are in use within their applications to assess the local exposure surface accurately.