# CVE-2026-86433: commonmark Attributes extension denial of service via quadratic parsing

Source: https://junglewise.ai/threats/cve-2026-86433-commonmark-attributes-extension-denial-of-service-via-quadratic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86433 · Severity: high · CVSS 7.5 · Published 2026-09-07

The League CommonMark library contains a denial-of-service vulnerability in its optional Attributes extension when processing markdown documents. An unauthenticated attacker can send a specially crafted 32 KB payload of repeated attribute blocks that causes the parser to consume excessive CPU time (over 5 seconds), degrading server performance and availability.

## Quick answers

**Is CVE-2026-86433 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86433 being exploited in the wild.

**How severe is CVE-2026-86433?** High severity, with a CVSS score of 7.5, published 7 September 2026.

**Which products and versions are affected?** League CommonMark 1.5.0 before 2.8.4.

**Is there a fix for CVE-2026-86433?** A patch was published on 2026-09-07. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86433 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86433?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an inefficient algorithmic complexity flaw (CWE-407) in the AttributesListener::findTargetAndDirection() method within the Attributes extension. When processing adjacent inline attribute blocks, the resolver walks through all siblings to find a target, resulting in O(N²) time complexity for N adjacent blocks. An attacker can trigger this worst-case behavior by submitting repeated attribute block patterns (e.g., {#a} repeated 8,000 times) without authentication or user interaction required. No configuration gating or allowlist validation prevents the quadratic walk. A fix is available in version 2.9.0 or later.

## Affected products

- League CommonMark 1.5.0 before 2.8.4

## Timeline

- 2026-08-03: disclosed
- 2026-09-07: patched

## References

- [https://github.com/thephpleague/commonmark/security/advisories/GHSA-g2gp-3wwq-f4ph](https://github.com/thephpleague/commonmark/security/advisories/GHSA-g2gp-3wwq-f4ph)
- [https://www.vulncheck.com/advisories/commonmark-1.5.0-before-2.8.4-denial-of-service-via-attributes](https://www.vulncheck.com/advisories/commonmark-1.5.0-before-2.8.4-denial-of-service-via-attributes)