Skip to main content

league/commonmark CVE-2026-86429

| EUVDEUVD-2026-72387 HIGH
Inefficient Algorithmic Complexity (CWE-407)
2026-09-07 VulnCheck GHSA-7x8h-jg2x-pjm5
Denial Of Service Commonmark Thephpleague
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Attacker submits crafted HTTP input with no auth or interaction; only availability is impacted via CPU exhaustion, no C or I.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
POC Analysis Generated
Sep 07, 2026 - 15:23 vuln.today
Patch available
Sep 07, 2026 - 14:02 EUVD
Source Code Evidence Fetched
Sep 07, 2026 - 13:30 vuln.today
Analysis Generated
Sep 07, 2026 - 13:30 vuln.today
CVE Published
Sep 07, 2026 - 12:53 cve.org
HIGH 8.7

DescriptionCVE.org

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents - such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes - to trigger disproportionate CPU consumption and cause a denial of service. Fixed in 2.9.1.

AnalysisAI

Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthenticated remote attackers to exhaust server CPU and cause denial of service by submitting small, specially crafted Markdown documents. Two non-default first-party extensions are affected: SmartPunctExtension, whose ReplaceUnpairedQuotesListener performs O(n²) string copying via AdjacentTextMerger on each unpaired quote node, and AttributesExtension, whose findTargetAndDirection() re-scans the entire sibling chain for every contiguous block-level Attributes node at O(n²/2) cost. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application explicitly instantiates and registers SmartPunctExtension or AttributesExtension (or both) on a league/commonmark Environment object - for example via Environment::addExtension(new SmartPunctExtension()) or new AttributesExtension(). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately reflects a remotely exploitable, unauthenticated availability-only vulnerability with low attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade league/commonmark to version 2.9.1 or later, which contains fixes for both O(n²) code paths via commits 04a5d11ef6bf2d0b927310810d6a2a85d3c184b9 and 2f611b599c51661b005dc45c16ceaa547546e687. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all applications in your environment using thephpleague/commonmark and determine whether SmartPunctExtension or AttributesExtension are explicitly enabled (unaffected if using only standard converters). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Commonmark

View all
CVE-2019-10010 MEDIUM POC
6.1 Mar 24

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to i
CVE-2018-20583 MEDIUM POC
6.1 Dec 30

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18
CVE-2026-86434 HIGH
8.7 Sep 07

Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by sub
CVE-2026-86433 HIGH
8.7 Sep 07

Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote den
CVE-2026-86430 HIGH
8.7 Sep 07

Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to
CVE-2026-86435 HIGH
8.7 Sep 07

Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to

CVE-2026-86428 HIGH
8.7 Sep 07

Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unaut
CVE-2026-86432 MEDIUM
6.9 Sep 07

Quadratic memory and output amplification in league/commonmark's XmlRenderer affects all 2.x releases from 2.0.0 through
CVE-2026-86431 MEDIUM
6.9 Sep 07

Cross-site scripting in league/commonmark 2.7.0-2.9.0 allows unauthenticated attackers to inject arbitrary JavaScript in
CVE-2026-30838 MEDIUM
6.1 Mar 07

The DisallowedRawHtml extension in PHP Commonmark (league/commonmark) versions prior to 2.8.1 can be bypassed by injecti

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all
CVE-2026-59094 HIGH POC
8.7
CVE-2026-71321 HIGH POC
7.5
CVE-2026-59887 HIGH POC
7.5
CVE-2026-73643 HIGH POC
7.5
CVE-2024-9631 HIGH POC
7.5
CVE-2026-27903 HIGH POC
7.5
CVE-2026-3988 HIGH POC
7.5
CVE-2026-45186 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-86429 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy