Redpacketsecurity Multiple CVEs in thephpleague/commonmark Expose Denial of Service Vulnerabilities
Article Content
- •Six CVEs identified in the thephpleague/commonmark library, affecting versions 1.5.0 to 2.8.4.
- •Vulnerabilities can lead to denial of service by consuming excessive CPU resources.
- •Immediate patching to version 2.9.1 or later is necessary for affected applications.
On September 7, 2026, six CVEs were published affecting the thephpleague/commonmark library, versions 1.5.0 to 2.8.4, with vulnerabilities leading to denial of service (DoS) attacks. CVE-2026-86429, CVE-2026-86434, CVE-2026-86430, CVE-2026-86428, CVE-2026-86435, and CVE-2026-86433 allow unauthenticated attackers to exploit specific Markdown parsing features, consuming excessive CPU resources and potentially causing service outages. The vulnerabilities arise from quadratic parsing complexities in various extensions, such as SmartPunctExtension and AttributesExtension. Internet-facing PHP applications, especially those processing user-generated Markdown, are primarily affected. No active exploitation has been confirmed, but the risk remains high due to the simplicity of the attack vectors. Patching to version 2.9.1 or later is recommended to mitigate the risks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Following this threat?
Track CVE-2026-86428 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…