league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.

league/commonmark versions before 2.9.1 are affected by multiple denial of service vulnerabilities in their Markdown parsing logic. Specifically, the fenced code block detection, reference link label lookup, and emphasis delimiter processing perform super-linear (potentially exponential) work on specially crafted input. Attackers can exploit this by submitting Markdown content containing long backtick runs, deeply nested brackets, or complex delimiter sequences. This causes disproportionate CPU consumption on the server, effectively blocking legitimate requests from completing. The vulnerability is classified as a ReDoS or algorithmic complexity attack vector. A fix is available in version 2.9.1 of the library. The issue has been documented across multiple security advisories including a GitHub Security Advisory and a VulnCheck entry.