CVE-2026-86433 — commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs qua…
Published: 2026-09-07 · CVSS: 8.7 · CVSS 4.0
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7