league/commonmark's AttributesExtension re-merged and re-filtered every attribute a node had already collected each time another attribute node was applied to it, and re-merged the whole set on each continuation line of an attribute block. Long runs of distinctly-named attributes were therefore resolved in quadratic time, which can be abused for denial of service. This completes the fix for GHSA-jjv6-8j6v-6j52, which covered only the class attribute; 2.9.1 and 2.9.2 carry that partial fix and remain vulnerable. Fixed in 2.10.0 by accumulating attributes incrementally instead of re-merging.