Denial of Service Vulnerability in CommonMark by The PHP League
CVE-2026-86435

8.7HIGH

Key Information:

Vendor

ThePHPleague

Status
Commonmark
Vendor
CVE Published:
7 September 2026

What is CVE-2026-86435?

A denial of service vulnerability exists in CommonMark, impacting versions from 1.5.0 up to but not including 2.8.4. This flaw lies in the Footnote extension, which inadequately manages duplicate footnote definitions. By exploiting this vulnerability, attackers can generate documents with repeated footnotes, leading to quadratic output expansion that severely consumes server memory and CPU resources, potentially causing significant performance degradation.

Affected Version(s)

commonmark 1.5.0 < 2.8.4

commonmark 2.8.4

References

https://github.com/thephpleague/commonmark/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/commonmark-1.5.0-bef...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

GrahamCampbell
.