Vulnerability · Published Sep 7, 2026 · Assigned by VulnCheck

CVE-2026-86435commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote

High 7.5

In plain English

A high-severity security flaw in commonmark from thephpleague. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	php-league-commonmark	no fix listed	DEBIAN-CVE-2026-86435
Debian:13	php-league-commonmark	no fix listed	DEBIAN-CVE-2026-86435
Debian:14	php-league-commonmark	2.9.0-1	DEBIAN-CVE-2026-86435
Ubuntu:26.04:LTS	php-league-commonmark	no fix listed	UBUNTU-CVE-2026-86435

Affected products (as reported)

Vendor	Product	Versions
thephpleague	commonmark	1.5.0 – before 2.8.4

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-jfm3-95jq-q3rf) vendor-advisory
VulnCheck Advisory: commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote third-party-advisory