CVE-2026-86433: commonmark Attributes Extension DoS Vulnerability

CVE-2026-86433 is a denial of service vulnerability in commonmark library versions 1.5.0 to 2.8.3. Attackers can exploit quadratic-time scanning in the Attributes extension to exhaust server resources with minimal input. This article covers technical details, affected versions, impact analysis, and mitigation strategies.

CVE-2026-86433 Overview

CVE-2026-86433 is a denial of service vulnerability in the league/commonmark PHP library. The flaw affects versions from 1.5.0 before 2.8.4 and resides in the Attributes extension. The AttributesListener::findTargetAndDirection() method performs quadratic-time scanning across sibling node lists during parsing. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to force parsing durations exceeding five seconds. Repeated requests exhaust CPU and worker resources on any web application that renders untrusted Markdown through the Attributes extension.

Critical Impact
Unauthenticated remote attackers can exhaust server CPU with small Markdown payloads, degrading availability of any application that parses attacker-supplied Markdown with the Attributes extension enabled.

Affected Products

league/commonmark versions 1.5.0 through 2.8.3
PHP applications using the CommonMark Attributes extension
Downstream frameworks and CMS platforms bundling vulnerable league/commonmark releases

Discovery Timeline

2026-09-07 - CVE-2026-86433 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86433

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw classified under [CWE-407: Inefficient Algorithmic Complexity]. During Markdown parsing, the Attributes extension attaches attribute blocks to adjacent nodes. The AttributesListener::findTargetAndDirection() routine walks sibling lists to determine attachment targets. When the input contains many consecutive attribute blocks, this walk repeats across each node, producing quadratic O(n²) behavior relative to input size. A payload of roughly 32 KB pushes parse time past five seconds on typical server hardware. Because parsing runs inline with request handling, each request occupies a worker until completion.

Root Cause

The root cause is the absence of bounded or memoized sibling traversal in findTargetAndDirection(). Each attribute block re-scans neighboring nodes without caching prior results or capping traversal depth. Input size therefore scales computation quadratically instead of linearly.

Attack Vector

An unauthenticated attacker submits crafted Markdown containing repeated attribute blocks to any endpoint that renders user-supplied Markdown. Common targets include comment forms, wiki pages, API endpoints, chat integrations, and preview handlers. The attack requires no privileges, no user interaction, and no session state. Sustained submission of such payloads produces a denial of service against the hosting web application. Refer to the GitHub Security Advisory and the VulnCheck Advisory on CommonMark DoS for technical detail.

Detection Methods for CVE-2026-86433

Indicators of Compromise

HTTP request bodies containing large volumes of repeated CommonMark attribute syntax such as {.class} or {#id key=value} blocks
Request payloads in the range of 30 KB or larger targeting Markdown rendering endpoints
PHP-FPM or worker processes showing sustained CPU saturation tied to league/commonmark parsing frames

Detection Strategies

Instrument application performance monitoring to flag Markdown parse operations exceeding a defined latency threshold, such as one second
Enable stack sampling in PHP profilers and alert on frames within AttributesListener::findTargetAndDirection()
Correlate spikes in HTTP 5xx or gateway timeout responses with request bodies that contain dense attribute-block content

Monitoring Recommendations

Track request duration percentiles for endpoints that render user-submitted Markdown and alert on sustained deviations
Log the size and structure of Markdown payloads submitted by unauthenticated clients for retrospective analysis
Monitor PHP worker pool saturation, request queue depth, and CPU utilization on servers exposing Markdown functionality

How to Mitigate CVE-2026-86433

Immediate Actions Required

Upgrade league/commonmark to version 2.8.4 or later using composer update league/commonmark
Audit application code and dependencies for transitive use of vulnerable versions
Enforce request body size limits on endpoints that accept Markdown from untrusted sources

Patch Information

The maintainers fixed the quadratic traversal in AttributesListener::findTargetAndDirection() in league/commonmark2.8.4. Details are published in the GitHub Security Advisory GHSA-g2gp-3wwq-f4ph. Applications must upgrade the direct dependency and rebuild any container images or deployment artifacts that embed the library.

Workarounds

Disable the Attributes extension in the CommonMark environment configuration if the feature is not required
Enforce a maximum input length on Markdown submissions, rejecting payloads above a safe threshold such as 16 KB
Deploy web application firewall rules that flag or rate-limit requests containing dense sequences of attribute-block syntax
Move Markdown rendering to an isolated worker pool with strict CPU time limits per request

bash

# Configuration example
composer require league/commonmark:^2.8.4
composer show league/commonmark | grep versions