Listen to this Post
How the Vulnerability Works
The Footnote extension in league/commonmark is vulnerable to a quadratic-complexity denial-of-service attack due to how it handles backreference lists for duplicate footnote definitions.
When the FootnoteExtension is registered on the Environment, the library processes Markdown documents through several listeners. The `GatherFootnotesListener` (populated by NumberFootnotesListener) records one backreference per footnote reference found in the document. For each footnote definition block, the renderer appends the entire collected backreference list, without ever de-duplicating or removing repeated definitions of the same label.
An attacker can exploit this by crafting a document that references a single label (e.g., [^a]) N times and also supplies N duplicate definitions of that same label (e.g., `[^a]: duplicate` repeated N times). Because the library never collapses these duplicate definitions, the rendering process produces N × N `FootnoteBackref` nodes. This results in O(N²) growth in output size, parse time, and peak memory consumption.
The vulnerable code path is opt-in — FootnoteExtension must be explicitly registered — but it is a commonly enabled GFM-style feature in many deployments. No other non-default configuration is required to reach this path.
An unauthenticated attacker can expand a ~10 KB request into a ~62 MB HTML response, consuming ~3 seconds of CPU and ~440 MB of peak memory. This is sufficient to OOM-kill a default 128 MB PHP worker, causing a denial of service. The impact is strictly availability — no confidentiality or integrity effects.
The Footnote extension was introduced in version 1.5.0 (May 2020) with this backref logic present from the first commit. All releases from 1.5.0 onward (including every 2.x through 2.8.x) are affected.
DailyCVE Form:
Platform: league/commonmark
Version: 1.5.0 – 2.8.x
Vulnerability: O(N²) Backref Blowup
Severity: High (7.5 CVSS)
date: 2026-08-06
Prediction: Patch expected 2026-08-06 (2.9.0)
What Undercode Say:
Check installed version composer show league/commonmark Verify FootnoteExtension is registered grep -r "FootnoteExtension" ./src/ Test payload size (10KB trigger) echo '<sup id="fnref-a"><a href="#fn-a" class="jetpack-footnote" title="Read footnote.">1</a></sup>: def\n' | head -c 10000
Analytics: The amplification factor is ~6,200× (10 KB input → 62 MB output). At N = 500, the parser generates 250,000 backref nodes. Peak memory reaches 440 MB — exceeding the default PHP memory limit of 128 MB by 3.4×. CPU time spikes to 3 seconds per request, enabling trivial DoS via repeated requests.
Exploit:
<h2 style="color: blue;">Crafting the payload:</h2>
<h2 style="color: blue;">1. Generate N duplicate `[^a]: foo` definitions</h2>
<ol>
<li>Generate N references to `[^a]` in the document body</li>
<li>Total size ≈ 10 KB when N ≈ 500</li>
<li>Resulting HTML contains N × N backref links
[bash]
// Example attack vector
$payload = str_repeat("<sup id="fnref2:a"><a href="#fn-a" class="jetpack-footnote" title="Read footnote.">1</a></sup>: def\n", 500) . "\n" . str_repeat("<sup id="fnref3:a"><a href="#fn-a" class="jetpack-footnote" title="Read footnote.">1</a></sup>\n", 500);
$converter = new CommonMarkConverter(['html_input' => 'strip']);
$converter->convert($payload); // OOM on 128MB worker
Protection:
Recommended: Upgrade to league/commonmark 2.9.0 or later.
Workarounds (if upgrade is not possible):
- Disable FootnoteExtension for untrusted input:
$environment = Environment::createCommonMarkEnvironment(); $environment->removeExtension(FootnoteExtension::class);
- Enforce aggressively small input-size limits — note that the ~10 KB trigger payload is well within typical request-body limits, so any cap must be set very low (e.g., < 5 KB) to be effective.
- Implement a request pre-filter to reject documents containing excessive duplicate footnote definitions before parsing.
Impact:
- Availability: Remote unauthenticated attacker can crash PHP workers via OOM, causing denial of service
- Confidentiality: None
- Integrity: None
- Attack Complexity: Low — simple Markdown payload, no authentication required
- Scope: All deployments with FootnoteExtension enabled on versions 1.5.0 through 2.8.x
- Remediation: Upgrade to 2.9.0 or disable the extension for untrusted content
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
