Snipe-It Resource-Exhaustion DoS: CommonMark parsing + note field validation fix

Key Vulnerability Information Summary Vulnerability Overview Title: Resource-Exhaustion DoS via Unbounded Acceptance Note Reaching Synchronous CommonMark Rendering Type: Resource-Exhaustion DoS (Denial of Service) Cause: Authenticated Snipe-It users can submit an unbounded field during the pending checkout acceptance process. This field lacks a server-side length limit at the route level. Once persisted, it is processed through the synchronous CommonMark rendering pipeline ( 2.8.2), causing CPU exhaustion of PHP worker processes. Root Causes (Two Layers): 1. is pinned to 2.8.2, constrained by Laravel’s requirement, and is affected by . 2. accepts the field without a server-side length limit. Impact Scope Affected Versions: <= 8.7.0 Fixed Version: 8.7.1 CVSS v3 Base Score: 6.5 / 10 (Medium) Attack Vector: Network; Complexity: Low; Privileges Required: None; User Interaction: None; Impact on Confidentiality/Integrity/Availability: None/None/High CWE: CWE-400 (Resource Exhaustion), CWE-1284 (Input not bounded or limited) Performance Data: ~847 ms/render @ 40,000 bytes; ~2.6 s/render @ 80,000 bytes (in v8.7.0 environment). Remediation Patch Commit: ("Fixed FD-5697 - upgraded commonmark, added max to comment"), released on 2026-08-11. Two-Layer Fix: - : Directly pins to , overriding Laravel’s constraint. - : Locks to 2.10.8, mitigating the upstream DoS. - : Adds , enforcing a length check on before persistence or notification. Regression Tests: New introduced, containing and . Temporary Mitigations (Workarounds): - Configure a non-synchronous queue driver in to decouple notification rendering from the request cycle. - Apply rate limiting to at the reverse proxy or WAF layer. - These mitigations do not replace upgrading; upgrading fixes both the parser vulnerability and the missing input bounds. POC / Exploit Code The page does not include a standalone POC code block, but provides key fix code snippets:

Goal Reached Thanks to every supporter — we hit 100%!

Snipe-It Resource-Exhaustion DoS: CommonMark parsing + note field validation fix

More from this source