CVE-2026-86435

HIGHCVSS 7.5

Description

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.

Timeline

Published:September 7th, 2026 1:20 PM

Last modified:September 7th, 2026 1:20 PM

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-407

References & Reports

Advisories, patches, and third-party reports

https://github.com/thephpleague/commonmark/security/advisories/GHSA-jfm3-95jq-q3rf
https://www.vulncheck.com/advisories/commonmark-1.5.0-before-2.8.4-denial-of-service-via-footnote

Source: NIST NVD · Data may lag official sources by up to one minute