GHSA-g2gp-3wwq-f4ph

Source

https://github.com/advisories/GHSA-g2gp-3wwq-f4ph

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-g2gp-3wwq-f4ph/GHSA-g2gp-3wwq-f4ph.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g2gp-3wwq-f4ph

Downstream

CLSA (3)

Published

2026-08-06T20:39:52Z

Modified

2026-08-06T20:45:15Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

league/commonmark: Denial of service via adjacent inline attribute blocks

Details

Impact

With the Attributes extension enabled, AttributesListener::findTargetAndDirection() resolves each attribute node's target by walking outward through its siblings. For a run of N adjacent inline attribute blocks placed at the start of a block (with nothing to their left), each node scans the entire sibling list to the far-right end before giving up and falling back to the parent. Each resolution is therefore Θ(N) and the whole run is Θ(N²).

Reaching the path requires AttributesExtension (opt-in, but first-party: League\CommonMark\Extension\Attributes\AttributesExtension). No other configuration matters — the quadratic walk runs unconditionally during parsing and is not gated by the attributes/allow allow-list, the on* hardening added in 2.7.0, or allow_unsafe_links. An unauthenticated attacker can submit a ~32 KB input ({#a} repeated 8,000 times) that takes over 5 seconds to convert, with time growing quadratically in input length — a cheap denial of service. Availability impact only. The Attributes extension was introduced in 1.5.0 (May 2020) with this outward-walk resolver present from the first commit, so all releases from 1.5.0 onward (including every 2.x) are affected.

Workarounds

There is no library-level configuration that gates the quadratic walk. Integrators who cannot upgrade can only reduce exposure indirectly:

Disable the Attributes extension for untrusted input, or
Impose a strict maximum input length before conversion — noting that because the cost is quadratic, even a modest cap must be small to meaningfully bound worst-case CPU.

Upgrading to a release containing the fix is recommended.

Database specific

{
    "cwe_ids":  [
        "CWE-407"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-06T20:39:52Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

Packagist / league/commonmark

Package

Name: league/commonmark
Purl: pkg:composer/league/commonmark

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.5.0

Fixed

2.9.0

Affected versions

1.*

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

2.*

2.0.0-beta1

2.0.0-beta2

2.0.0-beta3

2.0.0-rc1

2.0.0-rc2

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.1.0

2.1.1

2.1.2

2.1.3

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.5.0

2.5.1

2.5.2

2.5.3

2.6.0

2.6.1

2.6.2

2.7.0

2.7.1

2.8.0

2.8.1

2.8.2

2.8.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-g2gp-3wwq-f4ph/GHSA-g2gp-3wwq-f4ph.json"