CVE-2026-86433

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks t...

CVE-2026-86435

CVE-2026-86435 affects the PHP League/commonmark library (versions 1.5.0 through before 2.8.4) in its Footnote extension . The root cause is a failure to deduplicate footnote definitions, allowing an attacker to craft a document containing duplicate footnote definitions and references that trigge...

EUVD-2026-72392

league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...

EUVD-2026-72393

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessiv...

CVE-2026-86435 commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessiv...

CVE-2026-86433 commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks t...

EUVD-2026-72391

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks t...

CVE-2026-86433

commonmark (PHP Markdown parser) versions 1.5.0 through 2.8.3 contain a denial-of-service vulnerability in the Attributes extension . The root cause is that AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning , allowing an unauthenticated attacker to submit ...

CVE-2026-86432

commonmark (versions 2.0.0 through before 2.8.4) contains a denial of service vulnerability in its XmlRenderer component. The root cause is that the renderer emits depth-proportional indentation for every XML tag, so deeply nested Markdown or AST structures trigger quadratic memory consumption an...

EUVD-2026-72390

commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausti...

EUVD-2026-72386

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming...

CVE-2026-86429 commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes

The league/commonmark thephpleague/commonmark library in versions = 1.5.0 and 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment they are not enabled by default and are excluded from the...

CVE-2026-86428

PHP League CommonMark (versions 1.5.0 through before 2.10.0 ) is affected by a denial-of-service vulnerability in the AttributesExtension . When processing Markdown containing numerous distinctly-named attributes, the extension performs quadratic-time attribute merging and filtering , consuming d...

CVE-2026-86428 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming...

CVE-2026-86428 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming...

EUVD-2026-72387

The league/commonmark thephpleague/commonmark library in versions = 1.5.0 and 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment they are not enabled by default and are excluded from the...

CVE-2026-86429

CVE-2026-86429 affects the thephpleague/commonmark PHP library (versions ≥ 1.5.0,

PT-2026-86799

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks t...

PT-2026-86800

league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...

PT-2026-86801

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessiv...