THREAT OPS › Threat News › [GHSA] GHSA-mh25-x5hq-wrqp (high) — league/commonmark: Denial of service via colliding heading slugs
[GHSA] GHSA-mh25-x5hq-wrqp (high) — league/commonmark: Denial of service via colliding heading slugs
GHSA-mh25-x5hq-wrqp Severity: high CVE: None
league/commonmark: Denial of service via colliding heading slugs
### Impact
`UniqueSlugNormalizer::normalize()` makes each slug document-unique by searching for an unused numeric suffix, but **restarts that search from `1` on every collision**. The k-th heading that collapses to the same base slug performs k−1 array lookups, so K colliding slugs cost
Original source: https://github.com/advisories/GHSA-mh25-x5hq-wrqp