CVE-2026-86429

    Dashboard / Vulnerabilities / CVE-2026-86429

    CVE-2026-86429

    Published: 7 Sept 2026Last Modified: 20 Sept 2026

    Summary: commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes

    Details: The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service. Fixed in 2.9.1.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86429.json, https://github.com/thephpleague/commonmark/security/advisories/GHSA-jjv6-8j6v-6j52, https://nvd.nist.gov/vuln/detail/CVE-2026-86429, https://www.vulncheck.com/advisories/commonmark-before-2.9.1-denial-of-service-via-smartpunct-and-attributes

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fc33ca12575e98e57cdce7d5f38b2ca5335714b3
    Fixed -73cb188c785abfa7a7bec73487148202968274c6

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86429 | CVE-DB