CVE-2026-86428
Received Received - Intake

Denial of Service in CommonMark via AttributesExtension

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming disproportionate CPU resources and preventing legitimate requests from completing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86428
EUVD
EUVD-2026-72386

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
commonmark commonmark From 1.5.0 (inc) to 2.10.0 (exc)
thephpleague commonmark From 1.5.0 (inc) to 2.10.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86428 is a denial-of-service vulnerability in the commonmark library affecting versions 1.5.0 to 2.9.2. It occurs in the Attributes extension when processing distinctly-named attributes, causing quadratic-time complexity during attribute merging and filtering. This consumes excessive CPU resources and can prevent legitimate requests from completing.

Detection Guidance

To detect this vulnerability, check if your system uses commonmark versions 1.5.0 to 2.9.2 with the AttributesExtension registered. Inspect installed packages for commonmark and verify the version. If vulnerable, test with crafted Markdown containing numerous distinct attributes to observe excessive CPU usage.

Impact Analysis

Attackers can exploit this by submitting crafted Markdown with numerous distinct attribute names, causing high CPU usage. This may lead to service slowdowns or crashes, disrupting availability for other users. Systems processing untrusted Markdown are particularly at risk.

Mitigation Strategies

Immediately upgrade to commonmark version 2.10.0 or later to patch the vulnerability. If upgrading is not possible, disable the AttributesExtension for untrusted Markdown or implement strict input length limits as temporary workarounds.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86428. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart