CVE-2026-86433: commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
commonmarkto a version that resolves this vulnerability.Fixed in 2.8.4
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using commonmark versions from 1.5.0 through versions before 2.8.4 are affected when the Attributes extension is in use. An exposed parser that processes attacker-supplied Markdown can be targeted remotely without authentication.
What does an attacker need to send to trigger resource exhaustion?
The attacker needs to submit Markdown containing approximately 32 KB of repeated attribute blocks. The vulnerable sibling-list scanning behavior can make parsing take more than five seconds per input, allowing server resources to be exhausted.
What is the available remediation?
Upgrade commonmark to version 2.8.4 or later. The provided information does not identify a configuration workaround or mitigation for environments that cannot immediately upgrade.