{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/league/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2025-27144"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["commonmark (\u003e= 2.0.0, \u003c 2.9.0)","commonmark (\u003e= 1.5.0, \u003c 2.9.0)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","algorithmic-complexity","vulnerability"],"_cs_type":"advisory","_cs_vendors":["league"],"content_html":"\u003cp\u003eThe league/commonmark library, specifically versions 2.0.0 through 2.8.x, contains an algorithmic complexity vulnerability (CVE-2025-27144) within its \u003ccode\u003eUniqueSlugNormalizer\u003c/code\u003e component. This component is designed to ensure document-unique heading anchors by appending numeric suffixes to duplicate slugs. However, the implementation resets the search for an unused suffix to index '1' upon every collision. Consequently, processing K colliding slugs results in O(K²) time complexity.\u003c/p\u003e\n\u003cp\u003eAn attacker can exploit this by submitting a Markdown document containing a large number of headings that normalize to the same slug (e.g., identical text, empty headings, or punctuation-only strings). When parsed by applications utilizing extensions such as \u003ccode\u003eHeadingPermalinkExtension\u003c/code\u003e, \u003ccode\u003eFootnoteExtension\u003c/code\u003e, or \u003ccode\u003eTableOfContentsExtension\u003c/code\u003e with the default \u003ccode\u003ePER_DOCUMENT\u003c/code\u003e uniqueness setting, the processor consumes excessive CPU cycles, leading to a denial-of-service condition. Because this behavior occurs during the standard parsing process and requires no authentication, it poses a significant availability risk for web applications that render user-provided Markdown.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in CPU exhaustion, rendering the affected application unresponsive or significantly degraded. The vulnerability affects any service processing untrusted Markdown input using vulnerable versions of \u003ccode\u003eleague/commonmark\u003c/code\u003e. The scale of the impact depends on the configured document size limits; however, even moderately sized inputs can trigger multi-second stalls on a single thread.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize upgrading \u003ccode\u003eleague/commonmark\u003c/code\u003e to version 2.9.0 or later, which resolves the quadratic behavior. If an immediate upgrade is not feasible, apply one of the following mitigations:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eSet the \u003ccode\u003eslug_normalizer/unique\u003c/code\u003e configuration to \u003ccode\u003efalse\u003c/code\u003e (or \u003ccode\u003eUniqueSlugNormalizerInterface::DISABLED\u003c/code\u003e) to stop the de-duplication scan.\u003c/li\u003e\n\u003cli\u003eDisable the \u003ccode\u003eHeadingPermalinkExtension\u003c/code\u003e, \u003ccode\u003eTableOfContentsExtension\u003c/code\u003e, and \u003ccode\u003eFootnoteExtension\u003c/code\u003e when processing untrusted input.\u003c/li\u003e\n\u003cli\u003eImplement strict upstream constraints on document size or the number of headings allowed in a single input to prevent reaching the threshold where O(K²) complexity becomes destructive.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-06T21:29:33Z","date_published":"2026-08-06T21:29:30Z","id":"https://feed.craftedsignal.io/briefs/2026-08-league-commonmark-dos/","summary":"A quadratic time complexity vulnerability in the UniqueSlugNormalizer component of league/commonmark 2.x allows attackers to trigger CPU exhaustion via specially crafted Markdown documents.","title":"Algorithmic Complexity Denial of Service in league/commonmark","url":"https://feed.craftedsignal.io/briefs/2026-08-league-commonmark-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - League","version":"https://jsonfeed.org/version/1.1"}