CyberRota Analysis
AI-GeneratedVersions of league/commonmark prior to 2.6.0 are vulnerable to polynomial time complexity issues in Markdown parsing, which can be exploited by attackers to induce denial of service. By submitting specially crafted Markdown inputs, attackers can significantly degrade system performance and exhaust CPU resources, particularly when multiple requests are sent concurrently. Organizations using affected versions should prioritize remediation to prevent potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.