CVE-2026-86429 thephpleague CVE debrief

Who should care

Defenders who use the league/commonmark library in their environment should assess exposure and apply the patch. This includes developers, system administrators, and security teams.

Why it matters

CVE-2026-86429 is a denial-of-service vulnerability in the league/commonmark library that can cause high CPU consumption and system instability. Defenders should prioritize verifying exposure and applying the patch.

• Denial of service due to high CPU consumption
• Potential for system crashes or instability
• Need for verification of exposure and application of the patch

Technical summary

The league/commonmark library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. An unauthenticated attacker can submit small, specially crafted Markdown documents to trigger disproportionate CPU consumption and cause a denial of service. The vulnerability can be triggered by submitting small, specially crafted Markdown documents, such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes. The vulnerability is fixed in version 2.9.1.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability can cause high CPU consumption and denial of service.

Recommended defensive actions

• Verify if the league/commonmark library is used in the environment
• Check if the version of the library is less than 2.9.1
• Apply the patch by updating to version 2.9.1 or later
• Monitor for suspicious Markdown documents being submitted to the system
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by quadratic parsing complexity in the SmartPunctExtension and AttributesExtension of the league/commonmark library. The vulnerability can be triggered by submitting small, specially crafted Markdown documents.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.