GHSA-j8pm-gj4c-rq4x

### Impact Affected versions of `league/commonmark` perform super-linear work on three independent parsing paths, all of which are reachable on a stock `new CommonMarkConverter()` with default configuration and no extensions registered. Each trigger fits on a single line of input, so no complex Markdown structure is required. The three paths were introduced at different times. This advisory's version range is their union; the individual ranges are: | Path | Affected from | Affected through | |---|---|---| | 1. Fenced code block detection | `0.6.0` | `2.9.0` | | 2. Reference link label lookup | `0.6.0` | `2.9.0` | | 3. Emphasis / strikethrough delimiters (`*`, `_`, `~`) | `2.6.0` | `2.9.0` | | 3. Highlight delimiters (`=`) | `2.9.0` | `2.9.0` | **1. Fenced code block detection — quadratic, affected from 0.6.0.** `FencedCodeStartParser` matches the following pattern: ``` /^[ \t]*(?:`{3,}(?!.*`)|~{3,})/ ``` The lookahead enforces the CommonMark rule that a backtick fence's info string may not itself contain a backtick, but neither the lookahead nor the backtick run it guards is atomic or possessive. On a line consisting of a long backtick run, filler text, and a single trailing backtick, the quantifier gives back one character at a time and re-runs the lookahead across the remainder of the line on every candidate fence length. A 320 KB single line takes roughly 27 seconds to convert. The identical payload with one `x` character prefixed — which fails the parser's own leading-character guard — takes 0.011 seconds. `preg_last_error()` returns `0` at every input size tested, including runs of 160,000 characters, so PCRE never reaches `pcre.backtrack_limit` and this is sustained CPU consumption rather than an early bail-out. **2. Reference link label lookup — effectively quadratic, affected from 0.6.0.** When a shortcut or collapsed reference link is attempted, `CloseBracketParser::tryParseReference()` copies the entire span between the brackets and passes it to