CVE-2026-86435

CVE-2026-86435 is a denial-of-service vulnerability in the Footnote extension of the commonmark Markdown parser, affecting versions from 1.5.0 up to but not including 2.8.4, in which footnote definitions are not deduplicated. An attacker who can submit a crafted Markdown document containing duplicate footnote definitions and references triggers quadratic output expansion during rendering, consuming excessive memory and CPU. Per the CVSS 4.0 vector (network vector, no privileges, no user interaction, high availability impact on the vulnerable system; 8.7 High), an unauthenticated attacker can exhaust server resources and degrade or deny availability of the service rendering the document. Any application, site, or API that processes untrusted Markdown through an affected commonmark version with the Footnote extension enabled is affected. No public proof-of-concept or in-the-wild exploitation is known (not in CISA KEV), and the EPSS score of 0.3% (20th percentile) indicates a low probability of near-term exploitation.

What to do: Upgrade commonmark to version 2.8.4 or later, which deduplicates footnote definitions and resolves the flaw. Until patched, disable or restrict the Footnote extension for untrusted input and enforce maximum document size, request timeouts, and memory/CPU limits on Markdown-rendering endpoints. Check whether your application or service processes attacker-supplied Markdown through a commonmark version in the affected range (1.5.0 or higher, below 2.8.4).