CVE-2026-86433 in CommonMark
Summary
by MITRE • 09/07/2026
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The CommonMark library, a widely adopted reference implementation for the Markdown markup language, contains a significant denial of service vulnerability within its Attributes extension in versions ranging from 1.5.0 up to but not including 2.8.4. This flaw stems directly from an inefficient algorithmic approach used during the parsing process, specifically within the AttributesListener::findTargetAndDirection() method. The core technical issue is a quadratic-time complexity associated with scanning sibling lists in the document tree structure. When the parser encounters attribute blocks, it iterates through existing nodes to determine target and direction for applying those attributes. Because this iteration does not utilize optimized data structures or caching mechanisms, the computational cost grows exponentially relative to the number of siblings present at any given level in the parsed tree. This design oversight transforms a standard parsing operation into a resource-intensive process that scales poorly with input size.
The operational impact of this vulnerability is severe for applications relying on CommonMark to render user-generated content or untrusted markdown inputs. An attacker can exploit this flaw by submitting approximately 32 kilobytes of repeated attribute blocks. Due to the quadratic nature of the scanning algorithm, even a relatively small amount of maliciously crafted input forces the server's CPU to perform an excessive number of operations. In practical testing scenarios, such payloads have been observed causing parsing times to exceed five seconds per request. This latency spike effectively ties up server threads and consumes significant processing power, leading to a denial of service condition where legitimate users experience slow response times or complete connection timeouts as the system becomes overwhelmed by the computational load generated by these specific inputs.
From a security classification perspective, this vulnerability aligns with CWE-400, which covers Uncontrolled Resource Consumption, specifically manifesting as a Denial of Service through inefficient algorithms. It also maps to MITRE ATT&CK technique T1496, Resource Hijacking, where an attacker uses limited resources to cause degradation or loss of service for legitimate users. The vulnerability is particularly dangerous because it can be triggered by unauthenticated attackers without requiring any prior access privileges, making it a high-risk vector in public-facing web applications that process markdown content.
To mitigate this risk, organizations must immediately upgrade the CommonMark library to version 2.8.4 or later, where the underlying algorithm has been optimized to resolve the quadratic scanning issue. For environments where an immediate upgrade is not feasible, implementing input size limits on incoming markdown payloads can help restrict the maximum depth and breadth of sibling lists that trigger the inefficient code path. Additionally, deploying rate limiting mechanisms at the network or application gateway level can throttle requests from single sources, preventing any one user from exhausting server resources through repeated exploitation attempts. Regular security audits focusing on parser performance and algorithmic complexity in third-party libraries are essential to prevent similar issues in other components of the software stack.