CVE-2026-86432
commonmark 2.0.0 before 2.8.4 Denial of Service via XML
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
commonmark 2.0.0 before 2.8.4 Denial of Service via XML
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
- Record
CVE-2026-86432- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-405
- Updated
- 2026-11-02
EUVDEUVD-2026-72390
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
- Record
EUVD-2026-72390- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f58g-hmv8-g97m
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in...
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
- Record
GHSA-f58g-hmv8-g97m- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-405
- Updated
- 2026-11-02
NVD
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
- Record
CVE-2026-86432- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-405
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-86432
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
- Record
DEBIAN-CVE-2026-86432- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-86432
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
- Record
UBUNTU-CVE-2026-86432- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php-league-commonmarkDebian:12 |
All versions, plus listed versions 2.10.0-12.10.1-12.10.3-12.3.9-12.3.9-1+deb12u1 Show 20 moreShow less2.4.0-12.4.1-12.4.2-12.4.2-22.5.0-12.5.1-12.5.3-12.6.0-12.6.1-12.6.1-22.6.2-12.7.0-12.7.1-12.7.1-22.8.0-12.8.1-12.8.2-12.8.2-22.8.3-12.9.0-1 |
None known |
php-league-commonmarkDebian:13 |
All versions, plus listed versions 2.10.0-12.10.1-12.10.3-12.7.0-12.7.0-1+deb13u1 Show 8 moreShow less2.7.1-12.7.1-22.8.0-12.8.1-12.8.2-12.8.2-22.8.3-12.9.0-1 |
None known |
php-league-commonmarkDebian:14 |
before 2.9.0-1, plus listed versions 2.7.0-12.7.1-12.7.1-22.8.0-12.8.1-12.8.2-12.8.2-22.8.3-1 |
2.9.0-1 |
php-league-commonmarkUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.1.2-11.2.0-11.3.0-11.3.1-11.3.1-1ubuntu21.3.1-1ubuntu2+esm1 |
None known |
php-league-commonmarkUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.5.7-2build11.6.6-1build11.6.7-11.6.7-1ubuntu0.1~esm1 |
None known |
php-league-commonmarkUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.3.9-12.4.1-12.4.2-12.4.2-22.4.2-2ubuntu0.1~esm1 |
None known |
php-league-commonmarkUbuntu:26.04:LTS |
All versions, plus listed versions 2.7.0-12.7.1-22.8.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-86432 is a medium vulnerability (CVSS 6.9) in Thephpleague Commonmark, published September 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in php-league-commonmark 2.9.0-1.
References
github.com/thephpleague/commonmark/security/advisories/GHSA-mj63-m3rc-8ppr
vulncheck.com/advisories/commonmark-2.0.0-before-2.8.4-denial-of-service-via-xml
nvd.nist.gov/vuln/detail/CVE-2026-86432
security-tracker.debian.org/tracker/CVE-2026-86432
ubuntu.com/security/CVE-2026-86432
cve.org/CVERecord?id=CVE-2026-86432