CVE•Published 2026-09-07•Modified 2026-09-10•0 articles on news•5 live references•NVD data

CVE-2026-86430Thephpleague · Commonmark

Vulnerability data via NVD (ingested)

CVSS v3.1

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS percentile

Exploit Prediction Scoring System · top 79% of all CVEs

Weaknesses (CWE)

CWE-407Inefficient Algorithmic Complexity

Description

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.

Timeline

Published 2026-09-07

Modified 2026-09-10

External references

NVD MITRE Exploit-DB Sploitus VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common). Live host counts are a Premium feature.

Shodan · vuln tag

vuln:CVE-2026-86430

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Thephpleague Commonmark"

All exposed Thephpleague Commonmark instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Commonmark"

HTTP body or banner mentions "Commonmark" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2026-86430