CVE-2026-86429
Received Received - Intake

Quadratic Parsing Complexity in League CommonMark

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service. Fixed in 2.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86429
EUVD
EUVD-2026-72387

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
thephpleague commonmark From 1.5.0 (inc) to 2.9.1 (exc)
thephpleague commonmark 2.9.1
thephpleague commonmark From 1.5.0 (inc) to 2.9.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86429 is a denial-of-service vulnerability in the league/commonmark library versions 1.5.0 to 2.9.0. It affects the SmartPunctExtension and AttributesExtension, which are not enabled by default. Attackers can exploit inefficient parsing complexity by submitting specially crafted Markdown documents to consume excessive CPU resources and cause a denial of service.

Detection Guidance

Check if your system uses the vulnerable versions (1.5.0 to 2.9.0) of the league/commonmark library. Inspect installed packages with commands like 'composer show thephpleague/commonmark' or 'grep -r "commonmark" /path/to/project'. Monitor CPU usage spikes when processing Markdown input, especially with extensions enabled.

Impact Analysis

This vulnerability allows unauthenticated attackers to submit small, specially crafted Markdown documents that trigger disproportionate CPU consumption. This can lead to system slowdowns, unresponsive services, or complete denial of service, preventing legitimate users from accessing affected applications.

Compliance Impact

This vulnerability primarily impacts system availability due to CPU exhaustion from crafted Markdown processing. It does not directly expose or leak data, but prolonged DoS conditions could disrupt services handling regulated data. GDPR and HIPAA compliance may be indirectly affected if service disruptions impact data processing timelines or availability of critical systems.

Mitigation Strategies

Upgrade the league/commonmark library to version 2.9.1 or later. If upgrading is not immediately possible, disable the SmartPunctExtension and AttributesExtension in your configuration. Implement input length limits for Markdown processing to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86429. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart