Listen to this Post
UniqueSlugNormalizer::normalize() is designed to produce document-unique URL slugs for headings by appending a numeric suffix (e.g., -1, -2) when a collision is detected. However, the implementation suffers from a critical algorithmic flaw: on every collision, it restarts its search for an available suffix from 1. This means the k-th heading that collides onto the same base slug performs `k−1` array lookups, resulting in a total cost of `Σ(k−1) = O(K²)` for K colliding slugs.
An attacker can trivially force every heading in a document onto a single base slug. This is achieved by using many empty ATX headings (e.g., ), identical heading text, or punctuation-only headings that normalize to an empty string. The vulnerable code path is reached whenever the shared slug normalizer processes attacker-controlled text. This occurs when the `HeadingPermalinkExtension` is registered (its `HeadingPermalinkProcessor` normalizes every heading), independently through the `FootnoteExtension` (its `AnonymousFootnoteRefParser` normalizes every `^
` reference), and on any site using the `TableOfContentsExtension` (which requires `HeadingPermalinkExtension` to be co-registered). The default `slug_normalizer/unique` setting (<code>UniqueSlugNormalizerInterface::PER_DOCUMENT</code>) accumulates these collisions across the entire document, making the attack surface broad. No authentication is required; a carefully crafted, small document body can cause seconds of CPU time, effectively denying service. The impact is strictly on availability. The `UniqueSlugNormalizer` was introduced in version 2.0.0 (first shipped in 2.0.0-beta1, May 2021); the 1.x heading-permalink slug generator performed no de-duplication and is not affected. All 2.x releases, including 2.8.x, are vulnerable. <h2 style="color: blue;">DailyCVE Form:</h2> Platform: PHP library Version: 2.0.0-2.8.x Vulnerability: Quadratic DoS Severity: High date: 2026-08-03 <h2 style="color: blue;">Prediction: 2026-08-06</h2> <h2 style="color: blue;">What Undercode Say:</h2> The vulnerability stems from the <code>UniqueSlugNormalizer</code>'s naive collision resolution. The following analysis demonstrates the quadratic behavior. [bash] Simulate the collision cost for K headings for K in 100 200 400 800; do echo "K=$K: $((K(K-1)/2)) lookups" done
K=100: 4950 lookups K=200: 19900 lookups K=400: 79800 lookups K=800: 319600 lookups
The core issue is in the `normalize()` method:
// League\CommonMark\Normalizer\UniqueSlugNormalizer
public function normalize(string $text, string $context = ''): string
{
$baseSlug = $this->innerNormalizer->normalize($text, $context);
$slug = $baseSlug;
$i = 1;
while ($this->isUsed($slug)) {
$slug = $baseSlug . '-' . $i++; // Restarts from 1 on each collision
}
$this->usedSlugs[$slug] = true;
return $slug;
}
Exploit:
An attacker can trigger the vulnerability by supplying a Markdown document with a large number of colliding headings.
... (repeat 10,000 times)
Alternatively, using identical text:
collision collision collision ... (repeat 10,000 times)
Or punctuation-only headings:
... (repeat 10,000 times)
Each of these will normalize to the same base slug (empty string or “collision”), forcing the quadratic scan.
Protection:
Upgrade to the patched release (2.9.0 or higher) which removes the quadratic behavior while preserving unique IDs and identical output.
If immediate upgrade is not possible, implement one of the following workarounds:
– Set `slug_normalizer/unique` to `false` / UniqueSlugNormalizerInterface::DISABLED. This stops the de-duplication scan entirely, at the cost of losing ID uniqueness (colliding headings will share an anchor).
$environment->setConfiguration([ 'slug_normalizer' => [ 'unique' => UniqueSlugNormalizerInterface::DISABLED, ], ]);
– Disable `HeadingPermalinkExtension` (and TableOfContentsExtension, which depends on it), and `FootnoteExtension` where anonymous footnotes reach the same normalizer, for untrusted Markdown.
$environment->removeExtension(HeadingPermalinkExtension::class); $environment->removeExtension(TableOfContentsExtension::class); $environment->removeExtension(FootnoteExtension::class);
– Cap the accepted document size or heading count upstream so that K cannot reach the quadratic danger zone.
Impact:
- Availability: A small, specially crafted Markdown document can cause excessive CPU consumption, leading to denial of service.
- Scope: All 2.x releases of `league/commonmark` are affected.
- Attack Vector: Unauthenticated, remote attacker can send malicious Markdown content.
- No Data Breach: The vulnerability impacts availability only; no data confidentiality or integrity is compromised.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
