Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-86428

commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming disproportionate CPU resources and preventing legitimate requests from completing.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

thephpleague commonmark

Default version status: unaffected

  • 1.5.0 to < 2.10.0affected
  • 2.10.0unaffected
pkg:composer/league/commonmark

References