league/commonmark CVE-2026-86434

Exploitation requires that at least one of three extensions is registered in the target's league/commonmark environment: HeadingPermalinkExtension (direct), FootnoteExtension (via anonymous footnote ^[label] syntax), or TableOfContentsExtension (which implicitly requires HeadingPermalinkExtension). These extensions are not registered by default - integrators must explicitly add them to the environment. The attacker must additionally control Markdown content that reaches the parser, such as through a user-facing editor, documentation site, forum, or API accepting untrusted Markdown input. Exploitation is limited to availability impact only; no confidentiality or integrity breach is possible through this vector. Installations that process only trusted Markdown authored by developers or administrators, or that do not register any of the three affected extensions, are not at risk.

CVSS 4.0 scores this 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H), reflecting unauthenticated network exploitation with high availability impact; the vendor's AT:N choice implies they regard the required extension configuration as sufficiently common to warrant no attack-requirement modifier, though an argument for AT:P exists given the extensions are explicitly opt-in. No KEV listing and no confirmed public exploit code exist; however, the GHSA advisory provides sufficient technical detail that the attack is trivially reproducible using empty ATX headings alone, making 'no public exploit' a thin distinction in practice. EPSS data is not provided in the source intelligence. The O(K²) complexity makes exploitation efficiently automatable - doubling heading count quadruples CPU cost - meaning even a mid-sized municipal IT team in boleslawiec operating a documentation or CMS platform with heading-permalink or TOC features enabled should treat this as urgent given how little attacker effort is required. The impact is strictly availability; no confidentiality or integrity risk exists through this vector, which bounds the worst-case outcome to service disruption rather than data breach.

An attacker submits an HTTP request containing a Markdown body composed of hundreds or thousands of empty ATX heading lines (lines consisting solely of '#' characters) to a documentation platform, CMS, or API endpoint that renders untrusted Markdown using league/commonmark with HeadingPermalinkExtension or FootnoteExtension registered. Every empty heading normalizes to the same base slug, causing UniqueSlugNormalizer to perform O(K²) comparisons - a 1,000-heading document triggers approximately 500,000 array lookups, consuming significant CPU time and hanging or crashing the rendering worker. No exploit tooling beyond a crafted text file is required.