Vulnerability · Published Sep 7, 2026 · Assigned by VulnCheck
CVE-2026-86434commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
High 7.5
In plain English
A high-severity security flaw in commonmark from thephpleague. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | php-league-commonmark | no fix listed | DEBIAN-CVE-2026-86434 |
| Debian:13 | php-league-commonmark | no fix listed | DEBIAN-CVE-2026-86434 |
| Debian:14 | php-league-commonmark | 2.9.0-1 | DEBIAN-CVE-2026-86434 |
| Packagist | league/commonmark | 2.9.0 | GHSA-mh25-x5hq-wrqp |
| Ubuntu:26.04:LTS | php-league-commonmark | no fix listed | UBUNTU-CVE-2026-86434 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| thephpleague | commonmark | 2.0.0 – before 2.8.4 |
Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-mh25-x5hq-wrqp) vendor-advisory
- VulnCheck Advisory: commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision third-party-advisory