CVE-2026-86432: commonmark 2.0.0 before 2.8.4 Denial of Service via XML
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
commonmarkto a version that resolves this vulnerability.Fixed in 2.8.4
Event History
Frequently Asked Questions
Which deployments are exposed to resource exhaustion?
Deployments using commonmark versions from 2.0.0 before 2.8.4 are affected when XmlRenderer processes attacker-provided deeply nested Markdown or AST structures. The resulting XML output can consume memory quadratically and amplify output until server resources are exhausted.
Does exploitation require authentication or user interaction?
No. The provided severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.
What input would an attacker need to provide?
An attacker needs to supply deeply nested Markdown or AST structures that are rendered through XmlRenderer. Each XML tag receives indentation proportional to its depth, producing excessive output and memory use.