CVE-2026-86428 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes

High 8.7 Published 7 Sep 2026 Updated 8 Oct 2026

Attackers can cause denial of service in the commonmark library by submitting Markdown with numerous distinct attribute names, leading to excessive CPU consumption.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-86428?

CVE-2026-86428 is a high-severity denial of service vulnerability in thephpleague commonmark, published on 7 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming disproportionate CPU resources and preventing legitimate requests from completing.

Weakness: CWE-407

Which versions are affected by CVE-2026-86428?

2 open source packages ship an affected version, including league/commonmark. It affects 1 product.

Package	Affected	Fixed in
`league/commonmark` Packagist	From `1.5.0`	`2.10.0`
`league/commonmark` Packagist	From `1.5.0`	`2.10.0`

Products include Thephpleague Commonmark.

How do I fix CVE-2026-86428?

Upgrade league/commonmark to 2.10.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-86428 being exploited?

There is no known exploitation of CVE-2026-86428 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-86428, GHSA-8h74-w38m-j62j, GHSA-8rr7-cvq3-gmfh, UBUNTU-CVE-2026-86428.