commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-86434
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 13:31 UTC · Revision 1
Source evidence
commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
core-osv · Original sourcePublished 7 Sept 2026, 12:53 UTC
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.
osv:CVE-2026-86434
Complete source record
{
"id": "03ea23dfadd3e82cc54796059e0589e750dd3c14d44b1babcc64b4e21cb0010d",
"url": "https://osv.dev/vulnerability/CVE-2026-86434",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision",
"summary": "league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can force many headings onto a single base slug (e.g., via empty ATX headings, identical heading text, or punctuation-only headings) in a small Markdown document, consuming excessive CPU and denying service.",
"evidence": "osv:CVE-2026-86434",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-86434",
"aliases": [
"CVE-2026-86434",
"GHSA-mh25-x5hq-wrqp"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/thephpleague/commonmark",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "5703d83ba3da3b2e356a5fedc848ed6d8ffb6529"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.9.0"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"2.8.0",
"2.7.0",
"2.6.0",
"2.5.0",
"2.4.0",
"2.3.0",
"2.2.0",
"2.1.0",
"2.0.2",
"2.0.1",
"2.0.0",
"2.0.0-rc2",
"2.0.0-rc1",
"2.0.0-beta3",
"2.0.0-beta2",
"2.0.0-beta1",
"0.18.1",
"0.17.4",
"0.17.2",
"0.17.0",
"0.16.0",
"0.15.7",
"0.15.6",
"0.15.5",
"0.15.4",
"0.15.3",
"0.15.2",
"0.15.1",
"0.15.0",
"0.14.0",
"0.13.4",
"0.13.3",
"0.13.2",
"0.13.1",
"0.13.0",
"0.12.0",
"0.11.3",
"0.11.2",
"0.11.1",
"0.11.0",
"0.10.0",
"0.9.0",
"0.8.0",
"0.7.1",
"0.7.0",
"0.6.1",
"0.6.0",
"0.5.1",
"0.5.0",
"0.4.0",
"0.3.0",
"0.2.1",
"0.2.0",
"0.1.2",
"0.1.1",
"0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86434.json"
}
}
],
"modified": "2026-10-28T02:30:29.001924101Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86434.json",
"https://github.com/thephpleague/commonmark/security/advisories/GHSA-mh25-x5hq-wrqp",
"https://nvd.nist.gov/vuln/detail/CVE-2026-86434",
"https://www.vulncheck.com/advisories/commonmark-2.0.0-through-2.8.3-denial-of-service-via-slug-collision"
],
"provider_metadata": {
"cwe_ids": [
"CWE-407"
],
"cna_assigner": "VulnCheck",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.8.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
},
{
"extracted_events": [
{
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.8.4"
}
],
"source": "CPE_FIELD",
"strategy": "CPEApplicability"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86434.json"
}
},
"related_cves": [
{
"value": "CVE-2026-86434",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 495783,
"published_at": "2026-09-07T12:53:53.194+00:00"
}