Denial of Service Vulnerability in League/Commonmark Affected by Slug Collision

CVE-2026-86434

What is CVE-2026-86434?

A denial of service vulnerability exists in League/Commonmark versions from 2.0.0 to 2.8.3 due to the UniqueSlugNormalizer::normalize() method. When certain extensions like HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension are registered, an unauthenticated attacker can exploit this vulnerability by generating multiple headings that collapse to the same base slug. This occurs when the numeric-suffix search is restarted from 1 for each slug collision, resulting in a time complexity of O(K^2) for K headings sharing the same base slug. The attack vector allows for considerable CPU resource consumption, potentially denying service in small Markdown documents.

References