CVE-2026-86428 is a denial of service vulnerability in thephpleague commonmark's AttributesExtension affecting versions 1.5.0 through before 2.10.0. The vulnerability is due to an inefficient algorithmic complexity when processing numerous distinctly-named attributes, resulting in quadratic-time attribute merging and filtering. This can be exploited by attackers submitting specially crafted Markdown input with many distinct attribute names, causing disproportionate CPU resource consumption and preventing legitimate requests from completing.

Successful exploitation results in denial of service by exhausting CPU resources on the affected system, preventing legitimate requests from being processed. The vulnerability does not require privileges or user interaction and can be triggered remotely via network access to the vulnerable Markdown processing functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting or sanitizing user-supplied Markdown input to restrict the number of distinct attribute names to mitigate potential exploitation.