League/commonmark: Denial Of Service Via Colliding Heading Slugs

Impact "UniqueSlugNormalizer::normalize" makes each slug document-unique by searching for an unused numeric suffix, but restarts that search from "1" on every collision. The k-th heading that collapses to the same base slug performs k−1 array lookups, so K colliding slugs cost Σk−1 = OK². An...

CVE-2026-86434 commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision

league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...

CVE-2026-86434

league/commonmark versions = 2.0.0 and 2.9.0 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...

CVE-2026-86434: Inefficient Algorithmic Complexity

league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...

Inefficient Algorithmic Complexity

Overview league/commonmark is a PHP-based Markdown parser which supports the full CommonMark spec. It is based on the CommonMark JS reference implementation. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the FootnoteExtension process. An attacker can...