CVE-2026-86428 Overview
CVE-2026-86428 is a denial of service vulnerability affecting the thephpleague/commonmark PHP library. Versions from 1.5.0 before 2.10.0 contain flawed logic in the AttributesExtension when processing distinctly-named attributes. Attackers submit Markdown containing numerous distinct attribute names, triggering quadratic-time attribute merging and filtering. This behavior consumes disproportionate CPU resources and prevents legitimate requests from completing. The weakness is categorized as [CWE-407] Inefficient Algorithmic Complexity. Any web application that renders untrusted Markdown through commonmark with the AttributesExtension enabled is exposed to remote CPU exhaustion.
Critical Impact
An unauthenticated remote attacker can exhaust server CPU by submitting a single crafted Markdown payload, degrading or halting availability of the target application.
Affected Products
- thephpleague/commonmark versions >= 1.5.0
- thephpleague/commonmark versions < 2.10.0
- Applications using the AttributesExtension on untrusted Markdown input
Discovery Timeline
- 2026-09-07 - CVE-2026-86428 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86428
Vulnerability Analysis
The commonmark library parses Markdown into an abstract syntax tree and applies extensions during rendering. The AttributesExtension allows authors to attach HTML-like attributes to Markdown nodes using inline syntax. When the parser encounters many distinctly-named attributes on nearby nodes, the merging and filtering logic performs work proportional to the square of the attribute count. A modest input size therefore produces a large amount of processing on the server side.
Because commonmark is embedded in content management systems, forums, wikis, and API endpoints that accept Markdown, the attack surface is broad. A single HTTP request can occupy a worker thread long enough to starve concurrent legitimate requests. Repeated requests amplify the effect and can bring an application worker pool to full saturation without generating any obvious signature at the network layer.
Root Cause
The root cause is inefficient algorithmic complexity ([CWE-407]) inside the AttributesExtension attribute merging routine. Rather than deduplicating and combining attributes with linear-time data structures, the code path performs repeated scans across the growing attribute collection, yielding quadratic runtime as unique attribute names accumulate.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An adversary submits Markdown content, such as a comment, post body, README, chat message, or API field, that contains a large set of distinct attribute names attached to Markdown elements. The server-side commonmark parser processes the payload, and CPU utilization spikes as the AttributesExtension merges the attribute set. Repeated submissions produce sustained resource exhaustion.
No verified public exploit code has been published. See the GitHub Security Advisory and the VulnCheck Denial of Service Advisory for additional technical context.
Detection Methods for CVE-2026-86428
Indicators of Compromise
- Sustained high CPU utilization by PHP-FPM, PHP worker, or application server processes handling Markdown rendering endpoints.
- HTTP request bodies containing Markdown with unusually large numbers of distinct {#id .class key=value} attribute blocks.
- Increased request latency and timeouts on endpoints known to invoke commonmark with the AttributesExtension.
- Repeated requests from a single source targeting comment, post, or preview endpoints that render Markdown.
Detection Strategies
- Inventory application dependencies and flag any use of thephpleague/commonmark between 1.5.0 and 2.10.0 with the AttributesExtension registered.
- Instrument Markdown rendering paths with per-request CPU time metrics and alert on requests exceeding a defined threshold.
- Add web application firewall rules that inspect request bodies for excessive distinct attribute definitions in Markdown content.
Monitoring Recommendations
- Monitor application worker saturation, request queue depth, and 5xx error rates on endpoints that accept Markdown input.
- Correlate CPU exhaustion events with source IP addresses and request payload sizes to identify abuse patterns.
- Track Software Bill of Materials (SBOM) reports for the commonmark package version deployed across environments.
How to Mitigate CVE-2026-86428
Immediate Actions Required
- Upgrade thephpleague/commonmark to version 2.10.0 or later across all applications and container images.
- Audit application code for calls that register the AttributesExtension on parser environments processing untrusted input.
- Apply request-level CPU or execution time limits to Markdown rendering endpoints to contain resource exhaustion.
Patch Information
The maintainers fixed the quadratic behavior in commonmark 2.10.0. Update the dependency using Composer with composer require league/commonmark:^2.10.0 and redeploy affected services. Refer to the GitHub Security Advisory GHSA-8rr7-cvq3-gmfh for the authoritative fix details.
Workarounds
- Disable the AttributesExtension on parser environments that process untrusted Markdown until the library can be upgraded.
- Enforce input size limits on Markdown fields and reject payloads containing an unreasonable number of attribute blocks.
- Place Markdown rendering behind a rate limiter to reduce the impact of repeated malicious submissions.
# Upgrade commonmark to a patched release
composer require league/commonmark:^2.10.0
composer update league/commonmark
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
