CVE-2026-86429: commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes

Published Sep 7, 2026
·
Updated

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service. Fixed in 2.9.1.

Affected Software

1 affected component
composer/thephpleague/commonmark>=1.5.0<2.9.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade thephpleague/commonmark (league/commonmark) to a version that resolves this vulnerability.

    Fixed in 2.9.1

Event History

Sep 7, 2026
CVE Published
via MITRE·12:53 PM
Data Sourced
via MITRE·12:53 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are affected in practice?

Only deployments using league/commonmark versions 1.5.0 through versions before 2.9.1 that explicitly register SmartPunctExtension or AttributesExtension are affected. These extensions are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters.

2

What must an attacker be able to do?

An attacker needs to be able to submit Markdown that the application parses with either affected extension enabled. No authentication or user interaction is required, and specially crafted small documents can consume disproportionate CPU resources.

3

How can I determine whether my application is exposed?

Check the installed league/commonmark version and the Environment configuration for explicit registration of SmartPunctExtension or AttributesExtension. A version earlier than 2.9.1 is exposed only if at least one of those extensions is registered.

4

What should be done if upgrading cannot happen immediately?

Remove or disable SmartPunctExtension and AttributesExtension from the Environment where possible, especially for Markdown received from untrusted users. The issue is fixed in version 2.9.1.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203