league/commonmark generated footnote backrefs in quadratic time when a document contained duplicate footnote definitions, so such a document can be abused for denial of service. Footnote labels were also treated as dot- and slash-delimited key paths when storing backrefs, letting distinct labels such as [^a.b] and [^a/b] share a single backref list. Fixed in 2.9.0, which keeps only the first definition of a footnote label and stores backrefs under a single key.