CVE-2026-86434 in commonmark
Summary
by MITRE • 09/07/2026
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The league/commonmark library, specifically versions ranging from 2.0.0 to below 2.8.4 which were patched in version 2.9.0, contains a critical denial of service vulnerability within the UniqueSlugNormalizer::normalize() method. This flaw stems from an inefficient algorithmic approach used when generating unique identifiers for markdown elements such as headings, footnotes, or table of contents entries. When multiple items collapse to the same base slug due to identical text, empty content, or punctuation-only inputs, the normalizer attempts to resolve collisions by appending numeric suffixes. However, instead of maintaining a stateful counter that increments from the last known highest number for a specific slug, the implementation restarts its search for an available suffix at one every time a collision occurs. This design choice fundamentally alters the computational complexity of the operation, transforming what should be a linear or near-linear process into a quadratic one relative to the number of collisions.
The technical flaw is rooted in how the normalizer handles repeated slug generation within a single document processing session. When an attacker provides a markdown document containing numerous headings that normalize to the same base string, such as empty ATX headings which often result in identical slugs or strings composed entirely of punctuation marks that are stripped away during normalization, the system must assign unique identifiers to each instance. Because the algorithm resets its search for available numbers from one for every new collision rather than continuing from where it left off, it performs redundant checks against previously assigned suffixes repeatedly. For a document with K headings that all collapse to the same base slug, this results in O(K^2) time complexity. As K increases, the processing time grows exponentially, leading to significant CPU consumption and potential application hangs or crashes depending on server resources and timeout configurations.
This vulnerability is exploitable by unauthenticated attackers who can submit markdown content through any interface that utilizes the league/commonmark parser with specific extensions enabled. The vulnerable code path is triggered when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension are registered in the parsing configuration. These features rely heavily on generating unique slugs to create anchors for internal linking and navigation structures within rendered documents. By crafting a malicious markdown payload that forces many elements into a single slug bucket, an attacker can induce a resource exhaustion condition without needing any form of authentication. This makes it particularly dangerous for public-facing websites or APIs that accept user-generated content in markdown format, as the attack vector is straightforward to execute and difficult to detect until service degradation occurs.
From a security classification perspective, this issue aligns with CWE-400: Uncontrolled Resource Consumption, specifically manifesting as a Denial of Service via algorithmic complexity attacks. In terms of the MITRE ATT&CK framework, this vulnerability supports techniques associated with Impact or Availability disruption, where an adversary aims to degrade service quality by exhausting computational resources rather than compromising data integrity or confidentiality directly. The lack of input validation regarding the volume and nature of slug collisions allows for efficient exploitation using relatively small documents that trigger disproportionate processing loads on the backend systems parsing them.
Mitigation strategies primarily involve upgrading the league/commonmark library to version 2.9.0 or later, where this algorithmic inefficiency has been addressed by optimizing the suffix assignment logic to avoid redundant searches and maintain state across collisions within a single normalization context. For organizations unable to immediately upgrade, implementing rate limiting on markdown submission endpoints can help mitigate the impact of such attacks by restricting the volume of documents processed in short time windows. Additionally, introducing input sanitization that limits the number of headings or similar elements per document can reduce the likelihood of triggering the quadratic complexity threshold. Monitoring server CPU usage and response times for markdown processing services may also provide early detection signals for ongoing exploitation attempts, allowing security teams to respond before complete service outage occurs.