CVE-2026-86430: Inefficient Algorithmic Complexity in thephpleague commonmark

Thephpleague commonmark versions prior to 2.9.1 contain multiple denial of service vulnerabilities due to inefficient algorithmic complexity in three areas: fenced code block detection, reference link label lookup, and emphasis delimiter processing. These components perform super-linear computational work when processing crafted Markdown input containing long backtick runs, nested brackets, or delimiter sequences. This can be exploited by attackers to cause disproportionate CPU usage, preventing legitimate requests from completing.

Successful exploitation results in denial of service by exhausting CPU resources on the affected system, potentially disrupting service availability. The vulnerabilities do not require privileges or user interaction and can be triggered remotely via crafted Markdown input. There is no indication of data confidentiality or integrity impact.

A fix is available in version 2.9.1 of thephpleague commonmark. Users should upgrade to version 2.9.1 or later to remediate these denial of service vulnerabilities. No vendor advisory content was provided, so patch status is inferred from the version information. Patch status is confirmed by the version range indicating fixed in 2.9.1.