High severity · published Sep 7, 2026
CVE-2026-86435
commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
commonmark · thephpleague
1.5.0 before 2.8.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86435
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86435
vendor-advisory
https://github.com/thephpleague/commonmark/security/advisories/GHSA-jfm3-95jq-q3rf
third-party-advisory
https://www.vulncheck.com/advisories/commonmark-1.5.0-before-2.8.4-denial-of-service-via-footnote
More from commonmark
7.5
CVE-2026-105830
league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser
7.5
CVE-2024-58382
league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
7.5
CVE-2026-86434
commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
7.5
CVE-2026-86433
commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
7.5
CVE-2026-86430
league/commonmark before 2.9.1 Denial of Service via parsing