The league/commonmark library is susceptible to multiple denial of service vulnerabilities that allow unauthenticated attackers to exhaust system resources through algorithmic complexity attacks.

This vulnerability involves multiple flaws in how the library handles fenced code blocks, reference link labels, and emphasis delimiters. Due to inefficient algorithmic complexity (CWE-407), the parser performs super-linear work on specifically crafted input, which can be triggered by any unauthenticated user.

Successful exploitation of this vulnerability can lead to significant system downtime as the application becomes unresponsive due to CPU exhaustion. With a CVSS score of 7.5, the risk is high because the attack requires no authentication and can be executed remotely, potentially impacting the availability of any service relying on this library to process user-supplied Markdown.

Immediate Action: Update the league/commonmark dependency to version 2.9.1 or later immediately.

Proactive Monitoring: Monitor server CPU utilization metrics and application logs for unusual spikes or repeated requests containing long sequences of Markdown delimiters or nested brackets.

Compensating Controls: Implement request rate limiting and input size constraints to mitigate the impact of malicious payloads until the patch can be deployed.

Public Exploit Available: Unknown.

Given the ease of exploitation and the potential for service disruption, administrators should prioritize updating to version 2.9.1. Ensure that all downstream applications utilizing the commonmark library are patched to restore stability and prevent resource exhaustion attacks.