League/commonmark: Denial Of Service Via Colliding Heading Slugs

Impact "UniqueSlugNormalizer::normalize" makes each slug document-unique by searching for an unused numeric suffix, but restarts that search from "1" on every collision. The k-th heading that collapses to the same base slug performs k−1 array lookups, so K colliding slugs cost Σk−1 = OK². An...

CVE-2026-86434: Inefficient Algorithmic Complexity

league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...