Denial of Service Vulnerability in league/commonmark

The league/commonmark library, versions 2.0.0 through 2.8.3, contains a denial of service (DoS) vulnerability in the UniqueSlugNormalizer::normalize() function. The issue arises when an application enables specific extensions, namely HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension. The vulnerability occurs because the normalization logic resets its numeric-suffix search from 1 every time a slug collision is detected, leading to O(K^2) time complexity relative to the number of headings (K) that resolve to the same base slug. An unauthenticated attacker can supply a small, crafted Markdown document containing a high volume of headings that collapse into a single base slug (such as empty ATX headings or punctuation-only strings). This consumes excessive CPU resources on the server during the parsing phase, resulting in service unavailability. The vulnerability is addressed in version 2.9.0.

Impact

Successful exploitation allows an unauthenticated remote attacker to cause a denial of service on any application utilizing a vulnerable version of the library with the specified extensions enabled. By forcing significant CPU usage, attackers can degrade or completely halt web application services that process user-supplied Markdown content, impacting sites ranging from documentation platforms to content management systems.

Recommendation

1. Upgrade league/commonmark to version 2.9.0 or later immediately to resolve CVE-2026-86434.
2. Audit applications utilizing the library to identify those that have HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension enabled.
3. Implement input validation or size limits on user-supplied Markdown content to mitigate the potential for high-volume heading attacks if immediate patching is not feasible.