CVE-2026-86428

    Dashboard / Vulnerabilities / CVE-2026-86428

    CVE-2026-86428

    Published: 7 Sept 2026Last Modified: 11 Sept 2026

    Summary: commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes

    Details: commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming disproportionate CPU resources and preventing legitimate requests from completing.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86428.json, https://github.com/thephpleague/commonmark/security/advisories/GHSA-8rr7-cvq3-gmfh, https://nvd.nist.gov/vuln/detail/CVE-2026-86428, https://www.vulncheck.com/advisories/commonmark-1.5.0-before-2.10.0-denial-of-service-via-attributes

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fc33ca12575e98e57cdce7d5f38b2ca5335714b3
    Fixed -d2d1aa8b35e072966c89bc0c66cf926e56767dc4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86428 | CVE-DB