CVE-2026-86430
Received Received - Intake

Denial of Service in CommonMark Parser via Malicious Markdown

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86430
EUVD
EUVD-2026-72388

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
league commonmark to 2.9.1 (exc)
thephpleague commonmark From 0.6.0 (inc) to 2.9.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects league/commonmark versions before 2.9.1. It involves multiple denial of service issues where specially crafted Markdown input causes super-linear CPU time consumption. Attackers exploit long backtick runs, nested brackets, or delimiter sequences to hang the system and block legitimate requests.

Detection Guidance

This vulnerability is specific to the league/commonmark library and requires checking if your system uses a vulnerable version. Inspect installed packages for league/commonmark and verify version is below 2.9.1. No direct network detection commands are applicable as this is a library-level issue.

Impact Analysis

An attacker could send malicious Markdown to a vulnerable server, causing high CPU usage and making the system unresponsive. This could lead to service outages, slow response times, or denial of access for users trying to process normal requests.

Compliance Impact

This vulnerability primarily impacts system availability by causing denial of service through excessive CPU consumption. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA compliance. However, prolonged unavailability of systems could lead to violations of service level agreements or regulatory requirements for timely data access and processing.

Mitigation Strategies

Upgrade league/commonmark to version 2.9.1 or higher immediately. If using Composer, run 'composer update league/commonmark'. Review applications using this library and apply patches. Monitor for unusual CPU usage from Markdown processing tasks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86430. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart