CVE-2026-86435CWE-407

CVE-2026-86435

High · published September 7, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00488 · 41.1th percentile
Weakness
CWE-407 · Inefficient Algorithmic Complexity
Published
2026-09-07T17:20Z
References (2)
https://github.com/thephpleague/commonmark/security/advisories/GHSA-jfm3-95jq-q3rf · [email protected]https://www.vulncheck.com/advisories/commonmark-1.5.0-before-2.8.4-denial-of-service-via-footnote · [email protected]
EPSS history
Timeline
  • 09 SEP 03:20Z
    EPSS moved — → 0%
    epss
  • 07 SEP 12:53Z
    commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
    cvelistv5