Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-86430 – Denial of Service (Algorithmic Complexity) – league/commonmark 0.6.0 through 2.9.0

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-86430 affects league/commonmark, a widely used PHP library for parsing and rendering CommonMark/Markdown text, and is caused by multiple algorithmic-complexity (CWE-407) flaws that allow crafted Markdown input to trigger super-linear parsing time. The issue is remotely exploitable, requires no authentication or user interaction, and can be triggered with a default CommonMarkConverter() configuration (no extensions required), making it a practical denial-of-service risk for any application that converts untrusted Markdown input. The flaw carries a CVSS v4.0 score of 8.7 (High).

Technical details

  • Root cause: Three independent super-linear parsing paths exist in the core parser:
    • Fenced code block detection: A regex lookahead used to detect fenced code block openers exhibits catastrophic-backtracking-style behavior, causing a single line of backtick characters to be scanned in quadratic time (testing showed ~320 KB of input requiring roughly 27 seconds to convert).
    • Reference link label lookup: Shortcut reference link resolution repeatedly normalizes (trims, regex-replaces, encodes, and case-converts) nested bracket labels once at least one reference definition is present, resulting in effectively quadratic complexity for deeply nested bracket sequences.
    • Delimiter (emphasis/strikethrough/highlight) processing: Delimiter processors key an opener-search cache on the raw closer run length, leaving the cache key space unbounded and forcing repeated backward scans, producing super-linear (~n^1.5) behavior.
  • Trigger conditions: Each of the three triggers fits on a single line of crafted Markdown text; no complex document structure or special extensions are required.
  • Attack vector: Network — any endpoint that accepts and renders untrusted Markdown (comments, chat messages, documentation, README rendering, etc.) using league/commonmark is exposed.
  • Impact: CPU exhaustion / application-level denial of service. An unauthenticated remote attacker can submit a small, specially crafted Markdown payload that causes disproportionate CPU consumption on the parsing thread/process, potentially degrading or blocking availability for other users.

Affected software

  • league/commonmark versions >= 0.6.0 and < 2.9.1 (all three parsing paths are addressed together in 2.9.1; individual paths may have been introduced at different points within this range).

Severity

  • CVSS v4.0: 8.7 (High) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVSS v3.1: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Mitigation and recommended actions

  • Immediate: Upgrade league/commonmark to version 2.9.1 or later, which resolves all three identified parsing paths.
  • If immediate patching is not possible:
    • Apply request/processing timeouts and CPU/resource limits around any service that converts user-supplied Markdown, to bound worst-case parsing time.
    • Enforce strict input size limits on Markdown submitted by untrusted users, particularly limiting long runs of backtick characters, deeply nested bracket sequences (reference-style links), and long runs of emphasis/strikethrough delimiter characters.
    • Consider rate-limiting or queuing Markdown-rendering requests from a single source to reduce the blast radius of a CPU-exhaustion attempt.
    • Monitor for abnormal CPU spikes correlated with Markdown-rendering endpoints as an interim detection measure.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge