CVE-2026-86432: fallo de gravedad media en thephpleague commonmark
commonmark 2.0.0 before 2.8.4 Denial of Service via XML
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.4%
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Productos afectados
thephpleague · commonmarkCVEs relacionadas — thephpleague commonmark
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-71488HIGHleague/commonmark: Quadratic-time denial of service when parsing crafted MarkdownEPSS 0.6%CVE-2026-86429HIGHcommonmark before 2.9.1 Denial of Service via SmartPunct and AttributesEPSS 0.5%CVE-2026-86434HIGHcommonmark 2.0.0 through 2.8.3 Denial of Service via Slug CollisionEPSS 0.5%CVE-2026-86433HIGHcommonmark 1.5.0 before 2.8.4 Denial of Service via AttributesEPSS 0.5%CVE-2026-86430HIGHleague/commonmark before 2.9.1 Denial of Service via parsingEPSS 0.5%CVE-2026-86428HIGHcommonmark 1.5.0 before 2.10.0 Denial of Service via AttributesEPSS 0.5%