WS-2026-0051

league/commonmark parsed several constructs in quadratic time, any of which can be abused for denial of service: catastrophic backtracking in the fenced code block start pattern made a single line of backticks quadratic; shortcut reference link lookups normalized arbitrarily long labels once one...