CVE-2026-86430

league/commonmark, a widely used PHP Markdown parsing library, contains multiple algorithmic-complexity weaknesses (CWE-407) in fenced code block detection, reference link label lookup, and emphasis delimiter processing, causing super-linear CPU consumption on certain inputs. An attacker who can submit Markdown to an application using an affected version can send input with long backtick runs, deeply nested brackets, or long delimiter sequences that make parsing take disproportionate time. The result is denial of service: the parser consumes excessive CPU and delays or blocks legitimate requests, with no confidentiality or integrity impact, consistent with the CVSS 4.0 availability-only high score. Any PHP application, CMS, forum, or API embedding league/commonmark before 2.9.1 and rendering user-supplied Markdown is affected. No exploitation is currently known: EPSS is 0.3%, the flaw is not in CISA KEV, and no public proof-of-concept exists.

What to do: Upgrade league/commonmark to 2.9.1 or later, checking composer.lock and vendor dependency trees since it is frequently pulled in as a transitive dependency. Until patched, limit the size of and rate-limit Markdown accepted from untrusted users, and watch for public PoCs given the low but nonzero EPSS.