Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-86429— commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes

Quick assessment

Affected

thephpleague commonmark

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

The League of Extraordinary Packages league/commonmark是The League of Extraordinary Packages组织开源的一款Markdown解析组件。 The League of Extraordinary Packages league/commonmark 1.5.0至2.9.1之前版本存在资源管理错误漏洞，该漏洞源于SmartPunctExtension和AttributesExtension扩展存在二次解析复杂度问题，在显式注

CVSS 7.5 · High EPSS 0.52% · P43 Updated Oct 08, 2026

Possible ATT&CK Techniques 1 AI

T1020.001 · Traffic Duplication

Affected Version Matrix 2

Vendor	Product	Version Range	Status
thephpleague	commonmark	`1.5.0< 2.9.1`	affected
		`2.9.1`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86429

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes

Source: CVE Program / CVE List V5

Vulnerability Description

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service. Fixed in 2.9.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

算法复杂性

Source: CVE Program / CVE List V5

Vulnerability Title

The League of Extraordinary Packages league/commonmark 资源管理错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
thephpleague	commonmark	1.5.0 ~ 2.9.1	-

II. Public POCs for CVE-2026-86429

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-86429

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-86429 (2)

https://www.cve.org/CVERecord?id=CVE-2026-86429

Same Patch Batch · thephpleague · 2026-09-07 · 8 CVEs total

CVE-2026-86430	7.5 HIGH	league/commonmark before 2.9.1 Denial of Service via parsing
CVE-2026-86435	7.5 HIGH	commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
CVE-2026-86434	7.5 HIGH	commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
CVE-2026-86433	7.5 HIGH	commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
CVE-2026-86428	7.5 HIGH	commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes
CVE-2026-86431	7.2 HIGH	commonmark before 2.9.1 XSS via AttributesExtension form feed bypass
CVE-2026-86432	5.3 MEDIUM	commonmark 2.0.0 before 2.8.4 Denial of Service via XML

IV. Related Vulnerabilities

Same product: commonmark

Same vendor: thephpleague

Same weakness: CWE-407