CVE-2026-86435: commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote

Published Sep 7, 2026
·
Updated

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.

Affected Software

1 affected component
commonmark>=1.5.0<2.8.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade commonmark/Footnote extension to a version that resolves this vulnerability.

    Fixed in 2.8.4
  2. Compensating control

    Apply an update for the CommonMark Footnote extension vulnerability where versions from 1.5.0 before 2.8.4 fail to deduplicate footnote definitions; ensure the Footnote extension is not used with CommonMark versions in the affected range (1.5.0 through 2.8.3).

Event History

Sep 7, 2026
CVE Published
via MITRE·12:53 PM
Data Sourced
via MITRE·12:53 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are exposed?

Deployments using commonmark versions from 1.5.0 through versions before 2.8.4 are affected when the Footnote extension processes attacker-controlled documents.

2

What does an attacker need to do to trigger the issue?

An attacker needs to submit or otherwise cause processing of a document containing duplicate footnote definitions and references. No authentication or user interaction is required according to the supplied CVSS vector.

3

How can I determine whether my service is at risk?

Check the installed commonmark version and whether the Footnote extension is used to render untrusted or externally supplied documents. Versions before 2.8.4 within the stated affected range can produce quadratic output expansion from duplicate footnotes.

4

What is the remediation?

Upgrade commonmark to version 2.8.4 or later. The vulnerability can exhaust CPU and memory, causing a denial of service.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203