CVE-2026-86435: commonmark Footnote Extension DOS Vulnerability

CVE-2026-86435 Overview

CVE-2026-86435 is a denial of service vulnerability in the league/commonmark PHP Markdown parser. The flaw affects versions from 1.5.0 before 2.8.4 and resides in the Footnote extension. The extension fails to deduplicate footnote definitions, allowing attackers to trigger quadratic output expansion by submitting documents with duplicate footnote definitions and references. Processing such input consumes excessive memory and CPU, exhausting server resources. The vulnerability is classified under CWE-407: Inefficient Algorithmic Complexity.

Critical Impact
Unauthenticated attackers can exhaust server memory and CPU by submitting crafted Markdown documents to any endpoint that renders untrusted content through the affected Footnote extension.

Affected Products

league/commonmark versions 1.5.0 through 2.8.3
PHP applications embedding the CommonMark Footnote extension
Web platforms that render user-supplied Markdown using vulnerable versions

Discovery Timeline

2026-09-07 - CVE-2026-86435 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86435

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw in the Footnote extension of the league/commonmark parser. When the parser encounters footnote definitions and references, it does not deduplicate identical definitions. Each duplicate reference triggers repeated linking work against the growing set of definitions, producing output that scales quadratically with input size. A modestly sized Markdown document can generate output and processing costs that saturate available memory and CPU on the rendering host.

Because the parser is commonly invoked in request-handling paths, a single request can degrade or halt service for other users. Repeated requests amplify the effect and can extend the impact to shared resources such as PHP-FPM worker pools or container memory limits.

Root Cause

The Footnote extension accepts arbitrary numbers of definitions sharing the same label without collapsing them into a single canonical entry. Reference resolution iterates across the full definition list for each reference, yielding O(n²) work when references and definitions grow together. The parser also emits corresponding output for each duplicate, expanding the response body far beyond the input size.

Attack Vector

Exploitation requires only network access to an endpoint that renders untrusted Markdown, such as comment fields, wiki pages, chat integrations, or API-driven content pipelines. The attacker submits a crafted document containing many duplicate footnote definitions with matching references. No authentication or user interaction is required. Refer to the GitHub Security Advisory GHSA-jfm3-95jq-q3rf and the VulnCheck Denial of Service Advisory for additional technical detail.

No verified proof-of-concept code has been published. The vulnerability mechanism is documented in prose in the vendor advisory.

Detection Methods for CVE-2026-86435

Indicators of Compromise

Sustained high CPU or memory utilization on PHP worker processes handling Markdown rendering endpoints.
HTTP request bodies containing large numbers of repeated footnote definitions using the [^label]: syntax with matching [^label] references.
Rendering endpoints returning HTTP 5xx errors, timeouts, or out-of-memory failures after specific requests.

Detection Strategies

Inventory PHP applications and dependencies to identify installations of league/commonmark between 1.5.0 and 2.8.3.
Inspect web application firewall (WAF) logs for POST bodies containing dense clusters of footnote syntax tokens.
Correlate PHP-FPM slow-log entries with request payloads to identify Markdown rendering calls exceeding baseline execution times.

Monitoring Recommendations

Track per-request memory and CPU consumption for endpoints that invoke Markdown rendering.
Alert on repeated 5xx responses or process restarts originating from content submission endpoints.
Log request payload sizes and footnote token counts to detect anomalous submissions before parsing.

How to Mitigate CVE-2026-86435

Immediate Actions Required

Upgrade league/commonmark to version 2.8.4 or later using Composer.
Audit all application code paths that call CommonMarkConverter or enable the FootnoteExtension.
Apply request-size and rate limits on endpoints that accept user-supplied Markdown.

Patch Information

The vendor released the fix in league/commonmark version 2.8.4. Update dependencies with composer require league/commonmark:^2.8.4 and redeploy affected services. Full remediation details are available in the GitHub Security Advisory GHSA-jfm3-95jq-q3rf.

Workarounds

Disable the Footnote extension in application configuration if it is not required for business functionality.
Enforce maximum request body sizes and reject Markdown submissions exceeding a defined character or line count.
Set PHP memory_limit and max_execution_time conservatively for processes handling untrusted Markdown to contain resource exhaustion.

bash

# Upgrade league/commonmark to the patched release
composer require league/commonmark:^2.8.4
composer update league/commonmark