What is CVE-2026-86432?

CVE-2026-86432 is a medium-severity vulnerability in Thephpleague Commonmark, classified under Asymmetric Resource Consumption (Amplification). CVSS score: 5.3/10. Published 2026-09-07.

How severe is CVE-2026-86432?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Thephpleague Commonmark

CVE-2026-86432

commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Thephpleague Commonmark

Weakness classification (CWE)

CWE-405 — Asymmetric Resource Consumption (Amplification)

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-86432?: CVE-2026-86432 is a medium-severity vulnerability in Thephpleague Commonmark, classified under Asymmetric Resource Consumption (Amplification). CVSS score: 5.3/10. Published 2026-09-07.
How severe is CVE-2026-86432?: Medium severity. CVSS v3 base score is 5.3 out of 10.