CVE-2026-86430
league/commonmark before 2.9.1 Denial of Service via parsing
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
league/commonmark before 2.9.1 Denial of Service via parsing
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
- Record
CVE-2026-86430- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-02
EUVDEUVD-2026-72388
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
- Record
EUVD-2026-72388- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hxrj-xxg4-w3qp
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in...
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
- Record
GHSA-hxrj-xxg4-w3qp- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-02
NVD
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
- Record
CVE-2026-86430- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-02
OSV
league/commonmark before 2.9.1 Denial of Service via parsing
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
- Record
CVE-2026-86430- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-407
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-86430
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
- Record
DEBIAN-CVE-2026-86430- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-86430
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
- Record
UBUNTU-CVE-2026-86430- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php-league-commonmarkDebian:12 |
All versions, plus listed versions 2.10.0-12.10.1-12.10.3-12.3.9-12.3.9-1+deb12u1 Show 20 moreShow less2.4.0-12.4.1-12.4.2-12.4.2-22.5.0-12.5.1-12.5.3-12.6.0-12.6.1-12.6.1-22.6.2-12.7.0-12.7.1-12.7.1-22.8.0-12.8.1-12.8.2-12.8.2-22.8.3-12.9.0-1 |
None known |
php-league-commonmarkDebian:13 |
All versions, plus listed versions 2.10.0-12.10.1-12.10.3-12.7.0-12.7.0-1+deb13u1 Show 8 moreShow less2.7.1-12.7.1-22.8.0-12.8.1-12.8.2-12.8.2-22.8.3-12.9.0-1 |
None known |
php-league-commonmarkDebian:14 |
before 2.10.0-1, plus listed versions 2.7.0-12.7.1-12.7.1-22.8.0-12.8.1-1 Show 4 moreShow less2.8.2-12.8.2-22.8.3-12.9.0-1 |
2.10.0-1 |
php-league-commonmarkUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.1.2-11.2.0-11.3.0-11.3.1-11.3.1-1ubuntu21.3.1-1ubuntu2+esm1 |
None known |
php-league-commonmarkUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.5.7-2build11.6.6-1build11.6.7-11.6.7-1ubuntu0.1~esm1 |
None known |
php-league-commonmarkUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.3.9-12.4.1-12.4.2-12.4.2-22.4.2-2ubuntu0.1~esm1 |
None known |
php-league-commonmarkUbuntu:26.04:LTS |
All versions, plus listed versions 2.7.0-12.7.1-22.8.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-86430 is a high vulnerability (CVSS 8.7) in Thephpleague Commonmark, published September 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in php-league-commonmark 2.10.0-1.
References
github.com/thephpleague/commonmark/security/advisories/GHSA-j8pm-gj4c-rq4x
vulncheck.com/advisories/league-commonmark-before-2.9.1-denial-of-service-via-parsing
nvd.nist.gov/vuln/detail/CVE-2026-86430
security-tracker.debian.org/tracker/CVE-2026-86430
ubuntu.com/security/CVE-2026-86430
cve.org/CVERecord?id=CVE-2026-86430