Is CVE-2026-86435 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86435 being exploited in the wild.

How severe is CVE-2026-86435?

High severity, with a CVSS score of 7.5, published 7 September 2026.

Which products and versions are affected?

The PHP League CommonMark 1.5.0 before 2.8.4.

Is there a fix for CVE-2026-86435?

A patch was published on 2026: Fixed in version 2.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86435 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86435?

Check whether you run The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86435: commonmark Footnote extension denial of service

CVE-2026-86435 · Severity: high · CVSS 7.5 · Published 2026-09-07

commonmark is a Markdown parser library widely used in web applications and content management systems. The Footnote extension (an optional feature that processes footnote syntax in Markdown) contains a flaw that allows attackers to send specially crafted documents that cause the server to consume excessive CPU, memory, and time. A 10 KB malicious document can expand to 62 MB of output and consume 440 MB of peak memory, potentially crashing the application and denying service to legitimate users.

Technologies: The PHP League CommonMark. Vendors: The PHP League.

Quick answers

Is CVE-2026-86435 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86435 being exploited in the wild.
How severe is CVE-2026-86435?: High severity, with a CVSS score of 7.5, published 7 September 2026.
Which products and versions are affected?: The PHP League CommonMark 1.5.0 before 2.8.4.
Is there a fix for CVE-2026-86435?: A patch was published on 2026: Fixed in version 2.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86435 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86435?: Check whether you run The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an algorithmic denial of service (CWE-407) in the commonmark Footnote extension's backref processing logic. When processing duplicate footnote definitions and references for the same label, the GatherFootnotesListener and NumberFootnotesListener fail to deduplicate, resulting in O(N²) expansion where N is the number of duplicate references and definitions. The attack requires the Footnote extension to be registered (opt-in but commonly enabled for GFM-style parsing), network-reachable input, no authentication, and no user interaction. Attackers can craft documents with repeated footnote references and definitions to trigger quadratic output expansion, exhausting server resources and causing denial of service. The vulnerability affects all commonmark versions from 1.5.0 (where the Footnote extension was introduced with this flawed logic) through 2.8.3; patched in version 2.9.0.

Affected products

The PHP League commonmark 1.5.0 before 2.8.4

Timeline

2026-08-03: disclosed: GitHub Security Advisory GHSA-jfm3-95jq-q3rf published
2026-09-07: advisory: CVE-2026-86435 published on NVD
2026: patched: Fixed in version 2.9.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.