CVE-2026-86434: league/commonmark denial of service via slug collision

CVE-2026-86434 · Severity: high · CVSS 7.5 · Published 2026-09-07

league/commonmark is a PHP library used by websites to parse and render Markdown content. The library contains a performance flaw in its heading slug generation logic that causes it to perform redundant work when processing documents with many headings that normalize to identical names. An attacker can exploit this by submitting a Markdown document with many empty or identical headings, causing the server's CPU to spike and deny service to legitimate users, with no authentication required.

Quick answers

Is CVE-2026-86434 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86434 being exploited in the wild.
How severe is CVE-2026-86434?
High severity, with a CVSS score of 7.5, published 7 September 2026.
Which products and versions are affected?
league commonmark >= 2.0.0, < 2.8.4.
Is there a fix for CVE-2026-86434?
A patch was published on 2026-09-07: Patched in version 2.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86434 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-86434?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an algorithmic complexity flaw (CWE-407) in the UniqueSlugNormalizer::normalize() method. When multiple headings collapse to the same base slug (via empty ATX headings, identical text, or punctuation-only content), the normalizer restarts its numeric-suffix search from 1 on every collision, resulting in O(K²) time complexity for K colliding headings. The vulnerable code path is triggered whenever HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered and processes attacker-controlled Markdown. No authentication is required; a small document with many crafted headings can consume seconds of CPU, causing denial of service. The vulnerability affects all 2.x releases from 2.0.0 through 2.8.3; it was patched in version 2.9.0 by removing the quadratic behavior while preserving unique IDs.

Affected products

  • league commonmark >= 2.0.0, < 2.8.4

Timeline

  • 2026-08-03: disclosed: GitHub security advisory published
  • 2026-09-07: patched: Patched in version 2.9.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.