CVE-2026-86433
Received Received - Intake

Denial of Service in CommonMark Attributes Extension

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86433
EUVD
EUVD-2026-72391

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
commonmark commonmark From 1.5.0 (inc) to 2.8.4 (exc)
thephpleague commonmark From 1.5.0 (inc) to 2.8.4 (exc)
thephpleague commonmark From 1.5.0 (inc) to 2.8.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in commonmark versions 1.5.0 to 2.8.3. The Attributes extension has a flaw where AttributesListener::findTargetAndDirection() scans sibling lists in quadratic time. Attackers can send about 32 KB of repeated attribute blocks to slow parsing to over 5 seconds, consuming server resources.

Detection Guidance

Detecting this vulnerability requires monitoring for unusually long parsing times or high resource usage when processing commonmark input. Check server logs for requests containing repeated attribute blocks (approximately 32 KB of repeated attributes). Use system monitoring tools like top, htop, or ps to observe CPU and memory usage spikes during parsing operations.

Impact Analysis

Unauthenticated attackers could exploit this to degrade server performance or crash services by overwhelming the system with maliciously crafted input. This may lead to service unavailability for legitimate users.

Compliance Impact

This vulnerability primarily impacts availability by causing excessive server resource consumption through a denial-of-service attack. It does not directly affect confidentiality or integrity of data, which are key concerns for standards like GDPR and HIPAA. However, prolonged unavailability of systems could potentially lead to compliance violations if it disrupts access to personal or health data.

Mitigation Strategies

Upgrade commonmark to version 2.8.4 or later to address the denial of service vulnerability. If immediate upgrade is not possible, implement rate limiting on input size for commonmark parsing requests. Additionally, monitor server resources closely and consider temporarily disabling the Attributes extension if it is not critical to operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86433. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart