Skip to main content

league/commonmark CVE-2026-86432

| EUVDEUVD-2026-72390 MEDIUM
Asymmetric Resource Consumption (Amplification) (CWE-405)
2026-09-07 VulnCheck GHSA-f58g-hmv8-g97m
Denial Of Service Commonmark Thephpleague
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable, unauthenticated, zero-complexity attack once the endpoint exists; only availability impact at low severity as exhaustion is gradual.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Sep 07, 2026 - 14:02 EUVD
Source Code Evidence Fetched
Sep 07, 2026 - 13:35 vuln.today
Analysis Generated
Sep 07, 2026 - 13:35 vuln.today
CVE Published
Sep 07, 2026 - 12:53 cve.org
MEDIUM 6.9

DescriptionCVE.org

commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.

AnalysisAI

Quadratic memory and output amplification in league/commonmark's XmlRenderer affects all 2.x releases from 2.0.0 through at least 2.8.x, enabling remote unauthenticated denial of service against PHP applications that convert untrusted Markdown to XML. The renderer emits depth-proportional indentation for every XML tag, causing O(n²) byte growth in both output size and memory allocation for deeply nested structures - reachable with as little as a single line of nested blockquotes. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target application to route untrusted Markdown input through the opt-in XmlRenderer or MarkdownToXmlConverter code path - this is not the default rendering mode in league/commonmark (the default is HtmlRenderer). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.9 with VA:L reflects the limited but real blast radius: no confidentiality or integrity exposure, and an availability impact that manifests as gradual resource exhaustion rather than an immediate hard crash, which is why the GHSA advisory rates this Medium rather than High. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade league/commonmark to version 2.9.0 or later, which contains the fix per commit b5ac8c3947ca81844e85a09c7e0a5b4148bde2e1. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Commonmark

View all
CVE-2019-10010 MEDIUM POC
6.1 Mar 24

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to i
CVE-2018-20583 MEDIUM POC
6.1 Dec 30

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18
CVE-2026-86434 HIGH
8.7 Sep 07

Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by sub
CVE-2026-86433 HIGH
8.7 Sep 07

Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote den
CVE-2026-86429 HIGH
8.7 Sep 07

Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthent
CVE-2026-86430 HIGH
8.7 Sep 07

Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to
CVE-2026-86435 HIGH
8.7 Sep 07

Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to

CVE-2026-86428 HIGH
8.7 Sep 07

Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unaut
CVE-2026-86431 MEDIUM
6.9 Sep 07

Cross-site scripting in league/commonmark 2.7.0-2.9.0 allows unauthenticated attackers to inject arbitrary JavaScript in
CVE-2026-30838 MEDIUM
6.1 Mar 07

The DisallowedRawHtml extension in PHP Commonmark (league/commonmark) versions prior to 2.8.1 can be bypassed by injecti

Same weakness CWE-405 – Asymmetric Resource Consumption (Amplification)

View all
CVE-2026-87011 HIGH POC
7.5
CVE-2025-53633 CRITICAL
9.8
CVE-2026-84310 MEDIUM POC
4.8
CVE-2026-47774 HIGH
7.5
CVE-2026-54874 HIGH
7.5
CVE-2026-72914 HIGH
7.5
CVE-2025-30204 HIGH POC
7.5
CVE-2026-0485 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-86432 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy