CVE-2026-86432 — commonmark 2.0.0 before 2.8.4 Denial of Service via XML
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can p…
Published: 2026-09-07 · CVSS: 6.9 · CVSS 4.0
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7