CVE-2026-86430CWE-407

CVE-2026-86430

High · published September 7, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.4
In the wild
Unconfirmed
What it is

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00493 · 41.4th percentile
Weakness
CWE-407 · Inefficient Algorithmic Complexity
Published
2026-09-07T17:20Z
Affected products (1)
ProductVersionsFixed in
thephpleague/commonmark< 2.9.12.9.1
References (2)
https://github.com/thephpleague/commonmark/security/advisories/GHSA-j8pm-gj4c-rq4x · [email protected]https://www.vulncheck.com/advisories/league-commonmark-before-2.9.1-denial-of-service-via-parsing · [email protected]
EPSS history
Timeline
  • 09 SEP 03:20Z
    EPSS moved — → 0%
    epss
  • 07 SEP 12:53Z
    league/commonmark before 2.9.1 Denial of Service via parsing
    cvelistv5