CVE-2026-86435: commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-07 · updated 2026-10-08
Weakness: CWE-407

Description

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.

Affected products

thephpleague commonmark: from 1.5.0 before 2.8.4 — fixed in 2.8.4

How to fix

Upgrade to a fixed version: thephpleague commonmark 2.8.4. Check the vendor advisory for mitigations.

References

https://github.com/thephpleague/commonmark/security/advisories/GHSA-jfm3-95jq-q3rf
https://www.vulncheck.com/advisories/commonmark-1.5.0-before-2.8.4-denial-of-service-via-footnote

Get alerted when CVE-2026-86435 or the next vulnerability affects your stack