Executive brief
commonmark is a Markdown parser library widely used in web applications and content management systems. The Footnote extension (an optional feature that processes footnote syntax in Markdown) contains a flaw that allows attackers to send specially crafted documents that cause the server to consume excessive CPU, memory, and time. A 10 KB malicious document can expand to 62 MB of output and consume 440 MB of peak memory, potentially crashing the application and denying service to legitimate users.
Technical details
The vulnerability is an algorithmic denial of service (CWE-407) in the commonmark Footnote extension's backref processing logic. When processing duplicate footnote definitions and references for the same label, the GatherFootnotesListener and NumberFootnotesListener fail to deduplicate, resulting in O(N²) expansion where N is the number of duplicate references and definitions. The attack requires the Footnote extension to be registered (opt-in but commonly enabled for GFM-style parsing), network-reachable input, no authentication, and no user interaction. Attackers can craft documents with repeated footnote references and definitions to trigger quadratic output expansion, exhausting server resources and causing denial of service. The vulnerability affects all commonmark versions from 1.5.0 (where the Footnote extension was introduced with this flawed logic) through 2.8.3; patched in version 2.9.0.
Affected products
- The PHP League commonmark 1.5.0 before 2.8.4
Timeline
- 2026-08-03: disclosed: GitHub Security Advisory GHSA-jfm3-95jq-q3rf published
- 2026-09-07: advisory: CVE-2026-86435 published on NVD
- 2026: patched: Fixed in version 2.9.0