CVE-2026-86434: commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision

Published Sep 7, 2026
·
Updated

league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.

Affected Software

1 affected component
league/commonmark>=2.0.0<2.8.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade league/commonmark to a version that resolves this vulnerability.

    Fixed in 2.9.0
  2. Compensating control

    If you cannot upgrade immediately, prevent unauthenticated access to any Markdown rendering path that registers HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension to reduce exposure to slug-collision DoS.

Event History

Sep 7, 2026
CVE Published
via MITRE·12:53 PM
Data Sourced
via MITRE·12:53 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are exposed to this issue?

Deployments using league/commonmark versions 2.0.0 through 2.8.3 are affected when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. The vulnerable code path is not described as reachable without one of these extensions.

2

What does an attacker need to exploit it?

An unauthenticated attacker needs to be able to supply Markdown that the application processes. They can use many headings that resolve to the same base slug, such as empty ATX headings, identical heading text, or punctuation-only headings.

3

How can we determine whether our application is at risk?

Check the installed league/commonmark version and whether any of the three affected extensions are registered. Applications that process untrusted Markdown containing large numbers of colliding headings can experience excessive CPU consumption.

4

What should be done if the affected configuration is in use?

Update to a version containing the fix; the issue is stated as patched in 2.9.0. Until updating, limit or avoid processing untrusted Markdown that can contain many headings with the same normalized slug.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203