Denial of Service in CommonMark XML Renderer by The PHP League
CVE-2026-86432

6.9MEDIUM

Key Information:

Vendor

ThePHPleague

Status
Commonmark
Vendor
CVE Published:
7 September 2026

What is CVE-2026-86432?

Versions of CommonMark prior to 2.8.4 are susceptible to a denial of service vulnerability due to an issue in XmlRenderer. Attackers may exploit this vulnerability by submitting deeply nested Markdown or AST structures, leading to quadratic memory consumption and excessive output amplification. This can exhaust the server's resources, potentially resulting in service interruptions and performance degradation.

Affected Version(s)

commonmark 2.0.0 < 2.8.4

commonmark 2.8.4

References

https://github.com/thephpleague/commonmark/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/commonmark-2.0.0-bef...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

GrahamCampbell
.