These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-86435 is a denial-of-service vulnerability in commonmark versions from 1.5.0 before 2.8.4. The Footnote extension fails to deduplicate footnote definitions, allowing attackers to craft documents that cause quadratic output expansion. This consumes excessive memory and CPU, potentially exhausting server resources. The vulnerability affects commonmark deployments using the Footnote extension, parti [truncated]
A denial of service vulnerability exists in league/commonmark versions >= 2.0.0 and < 2.8.4. An unauthenticated attacker can force many headings onto a single base slug, consuming excessive CPU and denying service. The vulnerability is caused by the UniqueSlugNormalizer::normalize() method restarting its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headin [truncated]
CVE-2026-86433 is a denial-of-service vulnerability in commonmark versions from 1.5.0 before 2.8.4. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources. This vulnerability is caused by the Attributes extension in commonmark, where AttributesListener::findTargetAndDirection() performs quadratic-time sibli [truncated]
CVE-2026-86432 is a denial of service vulnerability in XmlRenderer of commonmark versions from 2.0.0 before 2.8.4. The vulnerability emits depth-proportional indentation for every XML tag, allowing attackers to provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
A cross-site scripting vulnerability exists in the AttributesExtension of league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1. This issue allows an attacker to inject a script by prefixing an attribute name with a single U+000C form feed byte, which bypasses the 'on*' event-handler filter and the allow_unsafe_links check. To exploit this vulnerability, an attacker must process untrus [truncated]
CVE-2026-86430 is a high-severity vulnerability in league/commonmark versions before 2.9.1, which contains multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing. Attackers can submit specially crafted Markdown to consume disproportionate CPU time and prevent legitimate requests from completing.
CVE-2026-86429 is a denial-of-service vulnerability in the league/commonmark library, which can cause high CPU consumption and system instability when an unauthenticated attacker submits specially crafted Markdown documents. The vulnerability is caused by quadratic parsing complexity in the SmartPunctExtension and AttributesExtension of the league/commonmark library. Defenders should prioritize verifying [truncated]
CVE-2026-86428 is a high-severity denial-of-service vulnerability affecting commonmark versions from 1.5.0 before 2.10.0. The vulnerability is located in the AttributesExtension and can be exploited by submitting Markdown with numerous distinct attribute names, causing quadratic-time attribute merging and filtering. This consumes disproportionate CPU resources, preventing legitimate requests from completing.
