Denial of Service Vulnerability in CommonMark by The PHP League
CVE-2026-86433

8.7HIGH

Key Information:

Vendor

ThePHPleague

Status
Commonmark
Vendor
CVE Published:
7 September 2026

What is CVE-2026-86433?

CommonMark, a popular Markdown parser, is susceptible to a denial of service vulnerability in its Attributes extension. Specifically, the function AttributesListener::findTargetAndDirection() can be exploited by unauthenticated attackers who submit approximately 32 KB of repetitive attribute blocks. This input leads to quadratic-time processing, causing server resource exhaustion and potentially crippling the application's performance for over five seconds. It is essential for users of versions from 1.5.0 up to but not including 2.8.4 to review their security posture and apply patches or mitigations.

Affected Version(s)

commonmark 1.5.0 < 2.8.4

commonmark 2.8.4

References

https://github.com/thephpleague/commonmark/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/commonmark-1.5.0-bef...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

GrahamCampbell
.