CVE-2026-86428

league/commonmark versions 1.5.0 through 2.9.x contain a denial-of-service flaw in the optional AttributesExtension, where merging and filtering distinctly-named attributes takes quadratic time (CWE-407). An attacker who can submit Markdown processed by this extension can include a large number of unique attribute names, causing disproportionate CPU consumption that starves the application of resources and prevents legitimate requests from completing. The impact is availability only — no data disclosure or integrity compromise — which is consistent with the CVSS 4.0 score of 8.7 (High) with high availability impact and no confidentiality/integrity impact. Any PHP application using league/commonmark between 1.5.0 and before 2.10.0 that enables the AttributesExtension on attacker-supplied Markdown is affected; deployments that do not enable the extension are not exposed. No public proof-of-concept, CISA KEV listing, or reports of in-the-wild exploitation are known, and EPSS puts 30-day exploitation probability at just 0.3%.

What to do: Upgrade league/commonmark to version 2.10.0 or later, which resolves the quadratic attribute-merging behavior. Where upgrading is not immediately possible, disable the AttributesExtension for untrusted Markdown, or cap Markdown input size and rate-limit rendering endpoints. Check your dependency tree (composer show league/commonmark) to determine whether the installed version falls in the 1.5.0–2.9.x range and whether your application enables the AttributesExtension.