CVE-2026-86429

The league/commonmark PHP Markdown parsing library (versions >= 1.5.0 and < 2.9.1) contains quadratic parsing complexity (CWE-407) in its SmartPunctExtension and AttributesExtension. The flaw is only triggered when one of these extensions is explicitly registered on a custom Environment — they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters — and an unauthenticated attacker who can submit Markdown to such a deployment can trigger it with small crafted documents (e.g., text alternating with unpaired quotes, runs of block-level attribute blocks, or repeated class attributes). The attacker gains a denial of service: disproportionate CPU consumption degrades or stalls the rendering process, with no confidentiality or integrity impact (CVSS 4.0 8.7 High, availability-only). Affected parties are PHP applications and services that use the library in the affected range and have either extension explicitly enabled while accepting untrusted Markdown. There is currently no known exploitation, no public proof-of-concept, no entry in CISA KEV, and a low EPSS score of 0.3%.

What to do: Upgrade league/commonmark to 2.9.1 or later. If upgrading is not immediately possible, remove or unregister the SmartPunct and Attributes extensions from custom Environments, or rate-limit/CPU-limit rendering of untrusted Markdown. Audit composer dependency trees for versions >= 1.5.0 and < 2.9.1 and review Environment configuration for SmartPunctExtension or AttributesExtension usage.