CVE-2026-86429: commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes
The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service. Fixed in 2.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
thephpleague/commonmark (league/commonmark)to a version that resolves this vulnerability.Fixed in 2.9.1
Event History
Frequently Asked Questions
Which deployments are affected in practice?
Only deployments using league/commonmark versions 1.5.0 through versions before 2.9.1 that explicitly register SmartPunctExtension or AttributesExtension are affected. These extensions are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters.
What must an attacker be able to do?
An attacker needs to be able to submit Markdown that the application parses with either affected extension enabled. No authentication or user interaction is required, and specially crafted small documents can consume disproportionate CPU resources.
How can I determine whether my application is exposed?
Check the installed league/commonmark version and the Environment configuration for explicit registration of SmartPunctExtension or AttributesExtension. A version earlier than 2.9.1 is exposed only if at least one of those extensions is registered.
What should be done if upgrading cannot happen immediately?
Remove or disable SmartPunctExtension and AttributesExtension from the Environment where possible, especially for Markdown received from untrusted users. The issue is fixed in version 2.9.1.