CVE-2026-86429: Thephpleague Commonmark DOS Vulnerability

CVE-2026-86429 Overview

CVE-2026-86429 is a denial of service vulnerability in the league/commonmark (thephpleague/commonmark) PHP Markdown parsing library. The flaw affects versions >= 1.5.0 and < 2.9.1 when either the SmartPunctExtension or AttributesExtension is registered on the Environment. Neither extension is enabled by default in the standard CommonMark or GitHub-Flavored Markdown converters. An unauthenticated attacker can submit small, specially crafted Markdown documents that trigger quadratic parsing complexity, causing disproportionate CPU consumption on the parsing host. The issue is tracked under [CWE-407] (Inefficient Algorithmic Complexity) and is fixed in version 2.9.1.

Critical Impact
A remote, unauthenticated attacker can exhaust CPU resources on any web application that parses attacker-controlled Markdown with the vulnerable extensions enabled, resulting in service degradation or outage.

Affected Products

thephpleague/commonmark versions >= 1.5.0 and < 2.9.1 with SmartPunctExtension registered
thephpleague/commonmark versions >= 1.5.0 and < 2.9.1 with AttributesExtension registered
PHP applications and content platforms that render user-supplied Markdown through these extensions

Discovery Timeline

2026-09-07 - CVE-2026-86429 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86429

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw in two optional extensions shipped with league/commonmark. When the parser processes certain input patterns, its runtime scales quadratically with input size rather than linearly. Small inputs measured in kilobytes can consume seconds of CPU time per request, and modest concurrency is sufficient to saturate a worker pool. Because Markdown parsing typically runs synchronously within request handlers, sustained abuse blocks legitimate traffic and can propagate as backend timeouts across the application tier.

Root Cause

The root cause lies in the parsing routines of SmartPunctExtension and AttributesExtension. The SmartPunctExtension performs quote pairing across delimiter runs, and adversarial input containing text alternating with unpaired quotes forces repeated backtracking or re-scanning. The AttributesExtension exhibits similar behavior when parsing contiguous runs of block-level attribute blocks or repeated class attributes, where each additional token increases per-token work.

Attack Vector

Exploitation requires no authentication and no user interaction. The attacker submits a crafted Markdown payload to any endpoint that invokes the vulnerable extensions — for example, comment fields, chat messages, wiki pages, issue trackers, or Markdown preview APIs. Representative payload shapes described in the advisory include text alternating with unpaired quote characters, contiguous runs of block-level attribute blocks such as {.a}{.b}{.c}..., and repeated class attribute declarations. Server CPU utilization spikes correlate directly with request submission. See the VulnCheck Denial of Service Advisory and the GitHub Security Advisory for details.

Detection Methods for CVE-2026-86429

Indicators of Compromise

Sustained PHP-FPM or web worker CPU at or near 100% with request queues backing up during Markdown rendering.
HTTP requests to Markdown-rendering endpoints containing long runs of quote characters, repeated {.class} attribute blocks, or dense attribute syntax.
Application logs showing slow-request warnings or timeouts localized to Markdown parsing paths.
Elevated 502 or 504 response rates from load balancers fronting Markdown-enabled services.

Detection Strategies

Inventory application dependencies for thephpleague/commonmark versions below 2.9.1 using composer show or software composition analysis tooling.
Audit Environment configuration in application code for calls that register SmartPunctExtension or AttributesExtension.
Add request-duration instrumentation around Markdown parsing calls and alert on outliers exceeding a defined threshold.

Monitoring Recommendations

Alert on Markdown-rendering endpoint response times exceeding baseline percentiles.
Track PHP worker saturation, request queue depth, and rejected connections on services exposing Markdown input.
Enable Web Application Firewall (WAF) rules to flag payloads with anomalous repetition of quote or attribute-block characters.

How to Mitigate CVE-2026-86429

Immediate Actions Required

Upgrade thephpleague/commonmark to version 2.9.1 or later via composer update league/commonmark.
If immediate upgrade is not feasible, remove or disable SmartPunctExtension and AttributesExtension from the Environment configuration.
Enforce a strict maximum size on Markdown input accepted from untrusted sources.
Impose per-request CPU or execution time limits on Markdown rendering workers.

Patch Information

The maintainers released a fix in league/commonmark version 2.9.1. Update via Composer and redeploy affected services. Full advisory and remediation details are available in the GitHub Security Advisory GHSA-jjv6-8j6v-6j52.

Workarounds

Unregister SmartPunctExtension and AttributesExtension from the Environment until upgrade is possible.
Cap request body size at the reverse proxy or application layer for Markdown-accepting endpoints.
Rate-limit unauthenticated access to Markdown parsing endpoints.
Deploy WAF signatures that reject payloads containing excessive runs of unpaired quotes or contiguous attribute blocks.

bash

# Upgrade league/commonmark to the patched release
composer require league/commonmark:^2.9.1
composer update league/commonmark

# Verify the installed version is 2.9.1 or later
composer show league/commonmark | grep versions