CVE-2026-86433

league/commonmark, a widely used PHP Markdown parsing library, versions 1.5.0 through 2.8.3 contain a denial-of-service flaw (CWE-407) in the Attributes extension, where AttributesListener::findTargetAndDirection() rescans the sibling node list in quadratic time as document size grows. An unauthenticated attacker who can get Markdown submitted for parsing can send roughly 32 KB of repeated attribute blocks, pushing a single parse above five seconds and exhausting CPU and server resources with only a small number of requests. The impact is availability only (CVSS 4.0 rates confidentiality and integrity impact as none), but sites that render attacker-supplied Markdown can be degraded or disrupted cheaply. Any PHP application embedding league/commonmark in the affected range with the Attributes extension enabled and parsing untrusted Markdown is affected. There is no known public proof-of-concept, it is not in CISA KEV, and EPSS is low (0.3%), indicating no confirmed exploitation yet.

What to do: Upgrade league/commonmark to 2.8.4 or later (or move out of the 1.5.0-2.8.3 range) via composer; check composer.lock and vendored copies for the installed version. Until patched, disable the Attributes extension or rate-limit and cap the size of untrusted Markdown input (the trigger is only ~32 KB). Prioritize applications where anonymous or unauthenticated users can submit Markdown that the server renders.