Vulnerability · Published Sep 7, 2026 · Assigned by VulnCheck

CVE-2026-86430league/commonmark before 2.9.1 Denial of Service via parsing

High 7.5

In plain English

A high-severity security flaw in commonmark from thephpleague. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	php-league-commonmark	no fix listed	DEBIAN-CVE-2026-86430
Debian:13	php-league-commonmark	no fix listed	DEBIAN-CVE-2026-86430
Debian:14	php-league-commonmark	2.10.0-1	DEBIAN-CVE-2026-86430
Packagist	league/commonmark	2.9.1	GHSA-j8pm-gj4c-rq4x
Ubuntu:26.04:LTS	php-league-commonmark	no fix listed	UBUNTU-CVE-2026-86430

Affected products (as reported)

Vendor	Product	Versions
thephpleague	commonmark	0.6.0 – before 2.9.1

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-j8pm-gj4c-rq4x) vendor-advisory
VulnCheck Advisory: league/commonmark before 2.9.1 Denial of Service via parsing third-party-advisory