CVE Alert: CVE-2026-86429 – thephpleague

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service. Fixed in 2.9.1.

## AI Summary Analysis

**Risk verdict:** High availability risk for exposed applications, but urgency is conditional because KEV, SSVC exploitation state and EPSS data are not provided.

**Why this matters:** An attacker can turn inexpensive input into disproportionate CPU consumption, potentially exhausting application workers and degrading or denying service. The likely business impact is loss of availability for content submission, rendering, publishing or API functions rather than data disclosure or modification. Exploitation is most concerning where parsing occurs synchronously or shares resources with other customer-facing services.

**Most likely attack path:** A remote attacker submits crafted Markdown to an endpoint that invokes the affected extensions; the path requires low effort, no credentials and no user action, with no special attack conditions. Scope is unchanged, so impact is primarily confined to the parsing service, although shared hosts, queues or worker pools could create practical lateral service disruption.

**Who is most exposed:** Internet-facing PHP applications offering Markdown previews, , forums, documentation, knowledge bases, ticketing or user-generated content are the main targets. Risk is higher where optional extensions are explicitly enabled, despite standard converters not using them by default.

Alert on sharp CPU increases correlated with Markdown POST requests.

Log unusually small requests causing long parse times or worker timeouts.

Identify repeated quote, attribute-block or class-heavy input patterns.

Monitor queue growth, PHP-FPM saturation and elevated 5xx responses.

Mitigation and prioritisation:

Upgrade promptly to the vendor-fixed release; prioritise internet-facing parsers.

Confirm whether the two optional extensions are registered and disable them where unnecessary.

Apply request-size, parsing-time, rate and concurrency limits as compensating controls.

Isolate parsing workers from unrelated services and test changes before production rollout.

KEV, SSVC and EPSS status are absent; obtain them before assigning P1 priority.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.