CVE-2026-86430: league/commonmark before 2.9.1 Denial of Service via parsing
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
league/commonmarkto a version that resolves this vulnerability.Fixed in 2.9.1 - Compensating control
Mitigate the impact by rate-limiting or otherwise restricting requests that can submit crafted Markdown content until the service is upgraded to league/commonmark 2.9.1 or later.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using league/commonmark versions before 2.9.1 are exposed if an attacker can cause them to parse attacker-controlled Markdown. The attacker does not need authentication or user interaction.
What kind of input is needed to trigger the denial of service?
The issue can be triggered with crafted Markdown containing long backtick runs, nested brackets, or emphasis delimiter sequences. These inputs cause fenced code block detection, reference link label lookup, or emphasis delimiter processing to perform super-linear work.
What is the impact during exploitation?
Parsing the crafted input can consume disproportionate CPU time, preventing legitimate requests from completing. The reported impact is availability only; no confidentiality or integrity impact is listed.
Which versions need to be remediated?
Versions before 2.9.1 are affected. Updating to 2.9.1 or later removes the affected version range described here.