Denial of Service Vulnerabilities in League/CommonMark by The PHP League
CVE-2026-86430

8.7HIGH

Key Information:

Vendor

ThePHPleague

Status
Commonmark
Vendor
CVE Published:
7 September 2026

What is CVE-2026-86430?

Multiple vulnerabilities in League/CommonMark prior to version 2.9.1 can lead to denial of service during the processing of specially crafted Markdown content. These vulnerabilities, due to their super-linear nature in handling fenced code blocks, reference link label lookup, and emphasis delimiter processing, can result in excessive CPU usage. An attacker can exploit these issues by submitting Markdown containing long backtick sequences, nested brackets, or complex delimiter patterns, effectively hindering legitimate requests and disrupting service availability.

Affected Version(s)

commonmark 0.6.0 < 2.9.1

commonmark 2.9.1

References

https://github.com/thephpleague/commonmark/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/league-commonmark-be...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

colinodell
.