CVE-2026-86435
Received Received - Intake

Denial of Service in CommonMark Footnote Extension

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86435
EUVD
EUVD-2026-72393

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thephpleague commonmark From 1.5.0 (inc) to 2.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86435 is a denial-of-service vulnerability in the PHP League's CommonMark library affecting versions 1.5.0 through 2.8.4. It occurs in the Footnote extension where duplicate footnote definitions cause exponential growth in processing time, memory usage, and output size. Attackers can exploit this by submitting small inputs that generate disproportionately large responses, potentially crashing servers with limited resources.

Detection Guidance

Check if the CommonMark library version is between 1.5.0 and 2.8.4. Use commands like 'composer show thephpleague/commonmark' or 'grep commonmark composer.lock' to inspect installed versions. If the Footnote extension is enabled, test with a crafted document containing duplicate footnote definitions to observe excessive resource usage.

Impact Analysis

This vulnerability can impact you by causing server crashes or degraded performance due to excessive memory and CPU consumption. Servers processing malicious documents may become unresponsive or slow, leading to downtime. The attack requires the Footnote extension to be enabled, which is common in GFM-style configurations.

Mitigation Strategies

Upgrade the CommonMark library to version 2.9.0 or later. If upgrading is not possible, disable the Footnote extension in your configuration. Monitor system resources for unusual spikes in memory or CPU usage as a potential sign of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart