CVE-2026-86434

CVE-2026-86434 is a denial-of-service flaw in the UniqueSlugNormalizer::normalize() method of the league/commonmark PHP Markdown library, which restarts its numeric-suffix search from 1 on every slug collision, producing O(K^2) processing time when K headings collapse to the same base slug. An unauthenticated attacker can trigger this with a small Markdown document containing many empty, identical, or punctuation-only ATX headings, causing excessive CPU consumption and service disruption. The vulnerable code path is reached only when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered in the application's markdown configuration. Applications and sites that render attacker-controlled Markdown with league/commonmark 2.x and any of these extensions are affected. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation has been reported, and EPSS puts 30-day exploitation probability at 0.3%.

What to do: Upgrade league/commonmark to 2.9.0, the patched release, and check composer.lock or vendored copies for vulnerable 2.x versions. If upgrading is not immediately possible, avoid registering HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension when rendering untrusted Markdown, or impose rate limits and document-size caps on Markdown-rendering endpoints. Monitor CPU usage on endpoints that accept Markdown input from unauthenticated users.