CVE-2026-71488

The commonmark parser quadratic DoS is not an Autolink extension problem—it is a core parser architectural flaw in how character offsets translate to byte positions during inline parsing, and disabling Autolink does not resolve it. The vulnerability operates through two amplification mechanisms. First, the parser's inline pass (handling emphasis, links, images) calls position lookups for every potential delimiter. Each lookup rescans the document from the start because the parser does not maintain incremental position state. Second, when input contains multibyte UTF-8 characters, the translation from character offset to byte offset triggers full re-traversal. The multiplicative effect is N delimiters × M bytes per translation = O(n²) worst case. The Autolink extension amplifies this by adding more translation-heavy operations per line, but the underlying algorithmic debt exists in the parser core itself. Any markdown input with sufficient delimiter density combined with multibyte characters will trigger quadratic behavior regardless of extension configuration. A single HTTP request with a few kilobytes of crafted input can exhaust CPU for seconds. The fix in version 2.9.0 almost certainly involved architectural changes—caching line-boundary tables, incremental position computation during the inline pass, or memoization of translated positions. This is not a one-line patch. Disabling Autolink reduces the attack surface slightly but leaves the core parsing path vulnerable. The only reliable mitigation is upgrading to 2.9.0 or later. For security teams: treat any pre-2.9.0 version as vulnerable regardless of Autolink settings. If you cannot upgrade, there is no configuration-only workaround—the vulnerability lives in the parser's position-tracking design, not in a feature toggle. Verify your deployed version against the changelog; if it does not mention parser refactoring or position-tracking changes, assume the architectural fix is absent. Additionally, audit any custom extensions, forks, or wrapper libraries that may have inherited the position-translation implementation without the patch—they exist outside the upgrade path entirely.

Reviewed through automated stages and approved by a human before publication.