league/commonmark CVE-2026-86435

The FootnoteExtension must be registered on the league/commonmark Environment - this is opt-in configuration but is described by the vendor as a commonly enabled GFM-style feature, making it present in a significant fraction of real deployments. No authentication is required; the attack is triggered by the content of the Markdown document alone. No non-default PHP configuration is needed beyond the FootnoteExtension being active. The amplification is deterministic: any document with duplicate [^label]: definition blocks combined with repeated references to the same label triggers the O(N²) behavior. Exploitation is limited to availability - no confidentiality or integrity impact is possible via this vector. Deployments that parse only trusted content (e.g., CMS editors used by authenticated authors) face negligible real-world risk despite the zero-privilege CVSS vector.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) is well-calibrated: the attack is network-reachable, requires zero authentication or user interaction, and produces high availability impact. The EPSS score is not provided in the source data. KEV status is negative and no public exploit code has been identified, meaning exploitation probability from opportunistic actors is currently lower than the severity score implies - however, the attack is conceptually trivial: an attacker needs only to construct a Markdown document with repeated footnote definitions. The critical limiting factor is that the FootnoteExtension must be registered on the commonmark Environment; this is opt-in but described by the vendor as a commonly enabled GFM-style feature. The amplification ratio (~10 KB → ~440 MB peak memory) is severe enough to constitute a practical single-request OOM attack against a default PHP-FPM worker configuration. No confidentiality or integrity impact is present. Real-world risk is medium-to-high for applications that accept arbitrary Markdown from untrusted users with the Footnote extension enabled; negligible for deployments that parse only trusted author-controlled content.

An attacker submitting Markdown to a public forum, comment system, or documentation platform built on league/commonmark with the FootnoteExtension enabled sends a single ~10 KB POST body containing a footnote label referenced and defined N times (e.g., 150 references and 150 duplicate definitions of [^a]:). The server's commonmark renderer generates 22,500 FootnoteBackref nodes, consuming ~440 MB of memory and ~3 seconds of CPU, OOM-killing the PHP-FPM worker and returning a 500 error. Repeating the request across a pool of workers can take down the entire application with minimal attacker bandwidth.