Denial of Service in PHP Markdown Parsing Library by The PHP League
CVE-2026-86429

8.7HIGH

Key Information:

Vendor

ThePHPleague

Status
Commonmark
Vendor
CVE Published:
7 September 2026

What is CVE-2026-86429?

The CommonMark library by The PHP League, specifically versions from 1.5.0 to below 2.9.1, has a vulnerability that allows an unauthenticated attacker to exploit the SmartPunctExtension and AttributesExtension. By sending specially crafted Markdown documents with specific patterns, attackers can trigger quadratic parsing complexity, resulting in excessive CPU consumption and potential service interruptions. This vulnerability poses a risk primarily when these extensions are registered on the Environment, although they are disabled by default. Users are advised to upgrade to version 2.9.1 or later to mitigate this risk.

Affected Version(s)

commonmark 1.5.0 < 2.9.1

commonmark 2.9.1

References

https://github.com/thephpleague/commonmark/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/commonmark-before-2....
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

colinodell
.