Commonmark (< 2.6.0)

The league/commonmark package versions prior to 2.6.0 contain a polynomial time complexity vulnerability allowing unauthenticated attackers to cause denial-of-service via crafted Markdown inputs.