CVE-2026-86428 in commonmark
Summary
by MITRE • 09/07/2026
commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming disproportionate CPU resources and preventing legitimate requests from completing.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The CommonMark library, specifically versions ranging from 1.5.0 up to but not including 2.10.0, contains a critical denial of service vulnerability within its AttributesExtension module. This flaw arises during the processing phase where Markdown content containing HTML-like attributes is parsed and merged into the final document structure. The core technical issue lies in how the extension handles distinctly-named attributes across multiple elements or nodes within a single input stream. When an attacker submits Markdown text that includes a large number of unique attribute names, such as id, class, style, data-foo, data-bar, and so on, the internal logic responsible for merging these attributes into a unified set exhibits quadratic time complexity relative to the number of distinct attributes encountered. This inefficiency means that as the count of unique attribute keys increases, the processing time does not grow linearly but rather squares, leading to exponentially longer execution times for each subsequent addition of new attribute types.
This algorithmic flaw allows an attacker to craft a malicious Markdown payload designed specifically to trigger this performance degradation. By including hundreds or thousands of distinct attribute names in the input data, the system is forced to perform excessive comparisons and merging operations during the parsing process. The result is a disproportionate consumption of CPU resources on the server side as it attempts to resolve these attributes for every element in the document tree. This resource exhaustion effectively creates a denial of service condition because the server becomes bogged down by the computational overhead, leaving insufficient capacity to handle legitimate user requests or other critical background tasks. Consequently, even if the input does not cause a crash, the application may become unresponsive or extremely slow, disrupting normal operations and potentially causing timeouts for genuine users attempting to access services that rely on this Markdown processing capability.
From a security classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, specifically manifesting as a Denial of Service through inefficient algorithmic complexity. It also relates to CWE-756, Missing or Incorrect Implementation of an Algorithm, where the implementation fails to account for worst-case scenarios involving large inputs. In terms of offensive security frameworks, this attack vector corresponds to MITRE ATT&CK technique T1496, Resource Hijacking, as it involves using system resources in a way that degrades performance for other processes or users without necessarily compromising confidentiality or integrity. The vulnerability is particularly dangerous because Markdown parsers are often exposed via web interfaces where user-generated content is processed automatically, providing an easy entry point for remote attackers to exploit this flaw from anywhere on the network.
To mitigate this risk, organizations using affected versions of CommonMark must upgrade immediately to version 2.10.0 or later, where the underlying algorithm has been optimized to handle attribute merging with improved efficiency, likely by employing hash maps or other data structures that offer constant-time lookups and merges rather than linear scans for each new attribute type. For environments where upgrading is not immediately feasible, defensive measures should include implementing strict input validation rules that limit the number of distinct attributes allowed per element or across a single document. Rate limiting on endpoints accepting Markdown content can also help mitigate the impact by preventing rapid-fire submission of large payloads. Additionally, deploying web application firewalls with specific rule sets to detect and block excessively long attribute lists in incoming requests provides an additional layer of defense against this type of resource exhaustion attack.