An authenticated Snipe-IT user with an assigned pending checkout acceptance can submit an unbounded note field to POST /account/accept/{acceptance}. The endpoint has no server-side length limit on the note; the value is persisted as-is (the underlying checkout_acceptances.note column is TEXT) and forwarded to AcceptanceItemDeclinedNotification, where it is rendered synchronously through the mail markdown pipeline by league/commonmark 2.8.2. Snipe-IT's default queue driver is sync (config/queue.php), so on any default install the parser work runs inside the request cycle and consumes PHP-worker CPU per submission.

Reporter demonstrated approximately 847 ms per render at 40,005 bytes and approximately 2.6 s per render at 80,000 bytes, on v8.7.0-pre. No confidentiality, integrity, privilege escalation, or code execution was demonstrated. The company/assignment authorization checks on the endpoint continue to function correctly; the defect is unbounded input reaching a vulnerable synchronous parser path.

Root cause is two-layer:

1. league/commonmark was pinned at 2.8.2 via Laravel's transitive ^2.8.1 requirement, which is affected by GHSA-2q4p-g7hv-5rgv.
2. AcceptanceController::store() accepted the note field without a server-side length limit before persistence or notification.

Patches

Fixed in commit 66770cfe20cb135e2b7022c7a83d01e6783c914a ("Fixed FD-56927 - upgraded commonmark, added max to comments"), 2026-08-11.

Two-layer fix:

• composer.json: added a direct require for league/commonmark: ^2.9.0 to override Laravel's ^2.8.1 peer constraint. composer.lock now pins league/commonmark 2.10.0, closing the upstream parser DoS.
• app/Http/Controllers/Account/AcceptanceController.php: added $request->validate(['note' => 'nullable|string|max:1000']) at the top of store(), before any DB or notification work. Defense in depth against future parser regressions and against any other input path that might reach markdown rendering.

Regression coverage added in tests/Feature/CheckoutAcceptances/Ui/AssetAcceptanceTest.php (test_oversized_note_is_rejected_before_persistence_or_notification, test_normal_length_note_still_works).

Workarounds

Operators running an affected release without upgrading can mitigate the immediate DoS surface by any of:

• Configuring a non-synchronous queue driver in config/queue.php / .env (moves notification rendering off the request cycle so parser work does not block user-facing requests).
• Rate-limiting POST /account/accept/{acceptance} at the reverse-proxy or WAF layer.

Neither is a substitute for upgrading, which closes both the parser vulnerability and the missing input bound.

Credit

PizzaStev3 (Ahmed Mohammed).