CVE-2026-86432
Received Received - Intake

XmlRenderer Denial of Service in CommonMark

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86432
EUVD
EUVD-2026-72390

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
commonmark commonmark From 2.0.0 (inc) to 2.8.4 (exc)
thephpleague commonmark From 2.0.0 (inc) to 2.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-405 The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86432 is a denial of service vulnerability in the XmlRenderer component of commonmark versions 2.0.0 to 2.8.3. Attackers exploit deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.

Detection Guidance

To detect this vulnerability, monitor for excessive memory usage or crashes when processing Markdown or XML output in commonmark versions 2.0.0 to 2.8.3. Check for processes running commonmark with high CPU or memory consumption during Markdown-to-XML conversion.

Impact Analysis

This vulnerability can degrade server performance or crash systems by consuming excessive memory and CPU resources. It may disrupt services relying on commonmark for Markdown to XML conversion, especially when processing untrusted input.

Mitigation Strategies

Upgrade commonmark to version 2.8.4 or later. If upgrading is not possible, lower the max_nesting_level setting, cap input size, implement memory limits, or prefer HTML rendering for untrusted content to reduce resource exhaustion risks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86432. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart