CVE-2026-86429

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86429
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86429.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86429
Aliases
Downstream
Published
2026-09-07T12:53:49Z
Modified
2026-09-09T03:30:30Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes
Details

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service. Fixed in 2.9.1.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86429.json"
}
References

Affected packages

Git / github.com/thephpleague/commonmark

Affected ranges

Type
GIT
Repo
https://github.com/thephpleague/commonmark
Events
Introduced
fc33ca12575e98e57cdce7d5f38b2ca5335714b3
Fixed
73cb188c785abfa7a7bec73487148202968274c6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.5.0"
        },
        {
            "fixed": "2.9.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86429.json"