The commonmark library for PHP is vulnerable to a denial of service attack via the Footnote extension, which could allow unauthenticated attackers to exhaust server memory and CPU resources.

This vulnerability, classified as CWE-407 (Inefficient Algorithmic Complexity), occurs because the Footnote extension fails to correctly deduplicate footnote definitions. An unauthenticated attacker can submit a maliciously crafted document to trigger quadratic output expansion, resulting in severe resource exhaustion.

The exploitation of this vulnerability can lead to significant system instability or complete service outages by consuming available CPU and memory. Given the CVSS score of 7.5, this high-severity flaw poses a direct threat to the availability of applications relying on commonmark for markdown processing, potentially resulting in downtime for critical business web services.

Immediate Action: Update the thephpleague commonmark library to version 2.8.4 or later to implement the necessary deduplication logic.

Proactive Monitoring: Monitor server CPU and memory utilization patterns for sudden, unexplained spikes that correlate with document processing tasks or markdown rendering endpoints.

Compensating Controls: Implement request rate limiting or payload size restrictions on endpoints that accept markdown input to mitigate the impact of resource-intensive document submissions.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

This vulnerability represents a significant risk to service availability through algorithmic complexity exploitation. IT administrators should prioritize upgrading to version 2.8.4 immediately to ensure the Footnote extension properly handles recursive or duplicate definitions. Failure to patch may leave systems susceptible to denial of service attacks that are trivial to execute.