# CVE-2026-86430: league/commonmark denial of service in parsing

Source: https://junglewise.ai/threats/cve-2026-86430-league-commonmark-denial-of-service-in-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86430 · Severity: high · CVSS 7.5 · Published 2026-09-07

league/commonmark is a popular PHP library that converts Markdown text into HTML. An attacker can submit specially crafted Markdown documents to the conversion function, causing the library to consume excessive CPU time and preventing legitimate requests from being processed. This is a denial-of-service vulnerability that can take a web application offline or degrade its performance without requiring authentication or complex attack setup.

Technologies: [league/commonmark (Packagist)](https://junglewise.ai/threats/technologies/league-commonmark). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-86430 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86430 being exploited in the wild.

**How severe is CVE-2026-86430?** High severity, with a CVSS score of 7.5, published 7 September 2026.

**Which products and versions are affected?** league/commonmark (Packagist) ECOSYSTEM:introduced=0.6.0,fixed=2.9.1.

**Is there a fix for CVE-2026-86430?** Yes. league/commonmark (Packagist): upgrade to 2.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86430 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86430?** Check whether you run league/commonmark (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- league/commonmark (Packagist): upgrade to 2.9.1 or later

  ```sh
  composer require league/commonmark:^2.9.1
  ```


## Technical details

league/commonmark versions 0.6.0 through 2.9.0 contain three independent algorithmic complexity vulnerabilities triggered during Markdown parsing: (1) quadratic behavior in fenced code block detection via non-atomic regex backreferences on long backtick runs; (2) quadratic behavior in reference link label normalization via repeated string operations on nested brackets; and (3) super-linear (approximately O(n^1.5)) behavior in emphasis delimiter processing due to unbounded cache key space. All three paths are reachable on a default CommonMarkConverter with no configuration changes or extensions needed. An unauthenticated attacker can craft a single-line input (e.g., 320 KB of backticks, deeply nested brackets, or delimiter sequences) to trigger sustained CPU consumption taking 20+ seconds. Repeated or concurrent requests exhaust available PHP workers. The vulnerability is patched in version 2.9.1 with possessive quantifiers and improved cache keying.

## Affected products

- The League commonmark 0.6.0 to 2.9.0

## Identifiers

- CVE-2026-86430
- GHSA-j8pm-gj4c-rq4x

## Timeline

- 2026-08-09: disclosed
- 2026-08-09: patched: Version 2.9.1 released

## References

- [https://github.com/thephpleague/commonmark/security/advisories/GHSA-j8pm-gj4c-rq4x](https://github.com/thephpleague/commonmark/security/advisories/GHSA-j8pm-gj4c-rq4x)
- [https://www.vulncheck.com/advisories/league-commonmark-before-2.9.1-denial-of-service-via-parsing](https://www.vulncheck.com/advisories/league-commonmark-before-2.9.1-denial-of-service-via-parsing)

## Related threats

- [league/commonmark DisallowedRawHtml XSS bypass in tag parsing](https://junglewise.ai/threats/league-commonmark-disallowedrawhtml-bypassed-when-a-disallowed-tag-name-cea607bc)
- [league/commonmark quadratic DoS in GitHub Flavored Markdown table parser](https://junglewise.ai/threats/league-commonmark-quadratic-time-denial-of-service-in-the-github-a4135205)
- [league/commonmark polynomial time complexity denial of service](https://junglewise.ai/threats/cve-2024-58382-league-commonmark-polynomial-time-complexity-denial-of-service)
- [league/commonmark AttributesExtension XSS bypass with U+000C](https://junglewise.ai/threats/cve-2026-86431-league-commonmark-attributesextension-xss-bypass-with-u-000c)
- [League CommonMark quadratic parsing complexity denial of service](https://junglewise.ai/threats/cve-2026-86429-league-commonmark-quadratic-parsing-complexity-denial-of-service)