Threat Intelligence Database

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.

A denial of service vulnerability exists in thephpleague commonmark versions from 1.5.0 up to but not including 2.8.4. The issue is in the Footnote extension, which fails to deduplicate footnote definitions. This allows attackers to craft documents with duplicate footnotes that cause quadratic output expansion, leading to excessive memory and CPU consumption that can exhaust server resources.

league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.

Thephpleague commonmark versions from 1.5.0 up to but not including 2.8.4 contain a denial of service vulnerability in the Attributes extension. This vulnerability arises because the AttributesListener::findTargetAndDirection() function performs quadratic-time scanning of sibling lists. An unauthenticated attacker can exploit this by submitting about 32 KB of repeated attribute blocks, causing the parser to take over 5 seconds and exhaust server resources.

CVE-2026-86432 is a denial of service vulnerability in thephpleague commonmark's XmlRenderer component. Versions from 2.0.0 up to but not including 2.8.4 are affected. The vulnerability arises because the XmlRenderer emits indentation proportional to the depth of XML tags, leading to quadratic memory consumption and output amplification when processing deeply nested Markdown or AST structures. This can exhaust server resources and cause service disruption.

A cross-site scripting (XSS) vulnerability exists in thephpleague/commonmark versions 2.7.0 up to but not including 2.9.1 in the AttributesExtension. This flaw allows an attacker to bypass attribute filtering by prefixing attribute names with a form feed character, leading to unsafe event handlers and javascript: URIs being rendered in HTML. The vulnerability is fixed in version 2.9.1.

CVE-2026-86430 is a high-severity denial of service vulnerability in thephpleague commonmark library versions before 2.9.1. It involves inefficient algorithmic complexity in processing fenced code blocks, reference link label lookups, and emphasis delimiters. Crafted Markdown input with long backtick runs, nested brackets, or delimiter sequences can cause excessive CPU consumption, disrupting legitimate requests.

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service. Fixed in 2.9.1.

Thephpleague commonmark versions from 1.5.0 up to but not including 2.10.0 contain a denial of service vulnerability due to inefficient algorithmic complexity in the AttributesExtension. This flaw allows attackers to submit Markdown with many distinct attribute names, causing quadratic-time processing that consumes excessive CPU resources and disrupts legitimate requests.

A vulnerability in thephpleague commonmark PHP library versions from 0.6.0 up to but not including 2.9.0 allows specially crafted Markdown input to cause quadratic time complexity during parsing. This inefficient algorithmic complexity can lead to disproportionate CPU consumption, resulting in a denial of service condition. The issue is resolved in version 2.9.0.