Cyber Resilience

CVE-2026-86430

DoS in Thephpleague Commonmark ≤ 2.9.1

Public PoCDoS
Published
07 September 2026
Modified
10 September 2026
Patch / advisory
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0029 21th percentile
Risk Priority 43 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-86430 is a high-severity Inefficient Algorithmic Complexity (CWE-407) vulnerability in Thephpleague Commonmark. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs,…

more

nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-86428Same product: Thephpleague Commonmark
CVE-2026-86429Same product: Thephpleague Commonmark
CVE-2026-86431Same product: Thephpleague Commonmark
CVE-2026-33347Same product: Thephpleague Commonmark
CVE-2026-30838Same product: Thephpleague Commonmark
CVE-2026-3276Shared CWE-407
CVE-2026-81722Shared CWE-407
CVE-2025-24946Shared CWE-407
CVE-2026-53433Shared CWE-407
CVE-2026-58059Shared CWE-407

Affected Assets

thephpleague
commonmark
≤ 2.9.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.2.9

Mitigating Controls (NIST 800-53 r5) AI

Denial-of-service protection directly reduces the impact of resource exhaustion triggered by worst-case algorithmic inputs.

Resource availability allocation limits blast radius when an inefficient algorithm is forced into its worst case.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.CM-09 partial match
prevents

Runtime monitoring of software and resources can detect the performance impact of triggered worst-case complexity.

ID.RA-01 partial match
prevents

Identifying and recording algorithmic-complexity vulnerabilities directly addresses the root cause before exploitation.

PR.PS-06 partial match
prevents

Secure SDLC practices (code review, complexity analysis, safe algorithm selection) prevent introduction of exploitable worst-case behavior.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

mitigates

Redundancy of processing facilities can absorb resource exhaustion from inefficient algorithms.

finds

Monitoring activities can identify anomalous resource consumption indicative of algorithmic complexity attacks.

prevents

Secure development life cycle includes design reviews that can catch inefficient algorithms before deployment.

prevents

Secure system architecture principles encourage selection of algorithms with acceptable worst-case complexity.

prevents

Secure coding practices can include guidelines to avoid or mitigate inefficient algorithms.

finds

Security testing can uncover performance issues stemming from algorithmic complexity.

References