league/commonmark CVE-2026-86430

All three vulnerable parsing paths are reachable against a stock new CommonMarkConverter() with default configuration and no extensions registered - no special server-side settings are required. For the fenced code block path, the trigger is a single line containing a long backtick run (3 or more backticks), followed by any filler text, followed by at least one trailing backtick; the line need not contain any other Markdown structure. For the reference link path, the document must contain at least one reference definition of any form (e.g., the 8-byte string '[x]: y') anywhere in the input - this unlocks the normalization path for all subsequent nested bracket spans. For the emphasis/delimiter path, a sequence of many consecutive delimiter characters (* _ ~ =) is sufficient. PCRE's built-in backtrack limit does not terminate the fenced code block path, meaning there is no automatic server-side protection from that layer. No authentication, session, or elevated privilege is required at the application level.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) scores 8.7 and accurately reflects the threat model: any network-reachable endpoint that accepts user-supplied Markdown and uses a default CommonMarkConverter instance is vulnerable with no authentication and no special attack complexity. All three paths are individually sufficient to cause denial of service; an attacker can target any one of them. The payload for the fenced code block path is a single line with no special Markdown structure, making automated delivery trivial. Even a mid-sized deployment team should treat this as urgent patching priority given the ease of triggering sustained CPU consumption with sub-kilobyte inputs. No KEV listing exists and no external POC code has been identified beyond the detailed triggering descriptions in the GHSA advisory itself, which effectively serves as a reproduction guide. EPSS was not provided in the input data, so exploitation probability cannot be quantified numerically; however, the extremely low attack complexity and zero authentication requirement suggest high automatable exploitation potential once an operator is targeted. The primary mitigating factor is that impact is limited strictly to availability - there is no confidentiality or integrity exposure confirmed.

An attacker identifies a public comment form, API endpoint, or wiki input field that renders Markdown using league/commonmark with default configuration. They submit a POST request containing a single line of 160,000 backtick characters followed by arbitrary text and one trailing backtick - a payload under 200 KB. The FencedCodeStartParser regex enters catastrophic backtracking, holding one PHP worker thread in CPU-bound parsing for tens of seconds. By sending a modest number of concurrent such requests, the attacker saturates the available PHP-FPM worker pool or server CPU, preventing all legitimate requests from completing until the connections time out.