Is CVE-2026-86432 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86432 being exploited in the wild.

How severe is CVE-2026-86432?

Medium severity, with a CVSS score of 5.3, published 7 September 2026.

Which products and versions are affected?

The PHP League CommonMark 2.0.0 to 2.8.3.

Is there a fix for CVE-2026-86432?

A patch was published on 2026-09-07: Version 2.9.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86432 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86432?

Check whether you run The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86432: commonmark XmlRenderer denial of service via nested XML indentation

CVE-2026-86432 · Severity: medium · CVSS 5.3 · Published 2026-09-07

The commonmark library is a popular Markdown-to-XML converter used by web applications to process user-supplied content. A flaw in its XML rendering feature causes quadratic memory consumption when processing deeply nested Markdown structures, allowing attackers to exhaust server resources through a single request containing nested blockquotes or crafted AST trees.

Technologies: The PHP League CommonMark. Vendors: The PHP League.

Quick answers

Is CVE-2026-86432 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86432 being exploited in the wild.
How severe is CVE-2026-86432?: Medium severity, with a CVSS score of 5.3, published 7 September 2026.
Which products and versions are affected?: The PHP League CommonMark 2.0.0 to 2.8.3.
Is there a fix for CVE-2026-86432?: A patch was published on 2026-09-07: Version 2.9.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86432 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86432?: Check whether you run The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The XmlRenderer component in commonmark emits indentation whitespace proportional to tree depth for every XML tag opening and closing, resulting in O(n²) bytes of memory and output for a tree of depth n. Attackers can trigger this through the MarkdownToXmlConverter with deeply nested Markdown (e.g. repeated blockquotes via str_repeat('> ', $depth)) or by passing a malicious AST directly to XmlRenderer::renderDocument(). The parser's max_nesting_level configuration can bound parser-generated trees but does not constrain programmatically built ASTs, and the default limit is high enough to reach damaging sizes. This amplification vulnerability affects all versions from 2.0.0 through 2.8.3; version 2.9.0 patches the issue. The HTML renderer does not emit depth-proportional indentation and is not vulnerable.

Affected products

The PHP League commonmark 2.0.0 to 2.8.3

Timeline

2026-08-03: disclosed
2026-09-07: patched: Version 2.9.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.