EUVD-2026-72393
GHSA-2cmp-7fm4-4v9w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth or interaction; scope unchanged (single PHP worker); availability-only impact via OOM exhaustion.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.
AnalysisAI
Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to exhaust PHP server resources by crafting documents with duplicate footnote definitions. The GatherFootnotesListener and NumberFootnotesListener classes append the full backref list for every duplicate definition without deduplication, producing O(N²) FootnoteBackref nodes - a ~10 KB crafted document expands into ~62 MB of HTML output, ~440 MB of peak memory, and ~3 seconds of CPU time, sufficient to OOM-kill a default 128 MB PHP worker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The FootnoteExtension must be registered on the league/commonmark Environment - this is opt-in configuration but is described by the vendor as a commonly enabled GFM-style feature, making it present in a significant fraction of real deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) is well-calibrated: the attack is network-reachable, requires zero authentication or user interaction, and produces high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to league/commonmark 2.9.0 or later via Composer (composer require league/commonmark:^2.9.0); the fix is delivered in commit 66028124a17ba193da7b11cc3dfda92df21bfbf4 referenced in GHSA-jfm3-95jq-q3rf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all PHP applications to identify use of league/commonmark library versions 1.5.0 through 2.8.x and confirm whether the Footnote extension is enabled in production; consult application dependencies and package manifests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Commonmark
View allCross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to i
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18
Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by sub
Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote den
Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthent
Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to
Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unaut
Quadratic memory and output amplification in league/commonmark's XmlRenderer affects all 2.x releases from 2.0.0 through
Cross-site scripting in league/commonmark 2.7.0-2.9.0 allows unauthenticated attackers to inject arbitrary JavaScript in
The DisallowedRawHtml extension in PHP Commonmark (league/commonmark) versions prior to 2.8.1 can be bypassed by injecti
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today