CVE-2026-86435

CVE-2026-86435 affects the PHP League/commonmark library (versions 1.5.0 through before 2.8.4) in its Footnote extension . The root cause is a failure to deduplicate footnote definitions, allowing an attacker to craft a document containing duplicate footnote definitions and references that trigge...

CVE-2026-86435 commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessiv...

EUVD-2026-72393

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessiv...

PT-2026-86801

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessiv...

GHSA-JFM3-95JQ-Q3RF league/commonmark: Denial of service via duplicate footnote definitions

Impact The Footnote extension records one backref per footnote reference and then appends the entire backref list for every footnote definition block in the document, without ever de-duplicating or removing repeated definitions of the same label GatherFootnotesListener, populated by...