CVE-2026-86434 json
commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
published 2026-08-06 3 mo ago modified 2026-10-20 20 d ago also EUVD-2026-72392 , GHSA-mh25-x5hq-wrqp
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.
Patch / fix
- packagist league/commonmark 2.9.0
- thephpleague commonmark 2.8.4
- php-league-commonmark Debian 14 2.9.0-1
debian advisories DEBIAN-CVE-2026-86434
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 51 d ago
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | league/commonmark | >=2.0.0, <2.9.0 |
2.9.0 |
Affected products
- thephpleague commonmark
Classification
- Weakness
-
- CWE-407 Inefficient Algorithmic Complexity
References
-
github.com
/thephpleague/commonmark/security/advisories/GHSA-mh25-x5hq-wrqp
vendor-advisory, web
-
vulncheck.com
/advisories/commonmark-2.0.0-through-2.8.3-denial-of-service-via-slug-collision
third-party-advisory
-
github.com
/thephpleague/commonmark
package
-
github.com
/thephpleague/commonmark/releases/tag/2.9.0
web
Sources
- CVE List CVE-2026-86434
- GitHub Advisory GHSA-mh25-x5hq-wrqp
- NVD CVE-2026-86434
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.