CVE-2026-86434
Received Received - Intake

Denial of Service in CommonMark

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86434
EUVD
EUVD-2026-72392

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
league commonmark From 2.0.0 (inc) to 2.8.4 (exc)
thephpleague commonmark From 2.0.0 (inc) to 2.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in league/commonmark versions between 2.0.0 and 2.8.4. It occurs in the UniqueSlugNormalizer::normalize() function, which inefficiently handles slug collisions by restarting its numeric suffix search from 1 repeatedly. This creates O(K^2) time complexity for K headings that produce the same base slug. Attackers can exploit this by forcing many headings into a single base slug using empty, identical, or punctuation-only headings in a small Markdown document, consuming excessive CPU resources.

Detection Guidance

Check if your system uses league/commonmark versions between 2.0.0 and 2.8.3. Run: composer show league/commonmark. If installed, verify version matches vulnerable range.

Impact Analysis

An unauthenticated attacker could exploit this to cause high CPU usage on systems processing Markdown documents with the vulnerable library. This could lead to degraded performance, system slowdowns, or complete denial of service for applications relying on league/commonmark for Markdown processing.

Compliance Impact

This vulnerability primarily impacts system availability by causing excessive CPU consumption through a denial-of-service attack. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged unavailability of systems processing personal or health data could lead to compliance violations due to interrupted access to critical data.

Mitigation Strategies

Upgrade league/commonmark to version 2.9.0 or later. For Composer projects: composer require league/commonmark:^2.9.0. Remove unused extensions like HeadingPermalinkExtension if not needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86434. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart