CVE-2026-86428: 
PHP vulnerability analysis and mitigation

CVE-2026-86428 is a denial-of-service vulnerability in the AttributesExtension of the league/commonmark PHP Markdown parsing library, affecting versions 1.5.0 through 2.9.2 (fixed in 2.10.0). The flaw causes quadratic-time CPU consumption when processing Markdown containing numerous distinctly-named attributes, allowing unauthenticated attackers to exhaust server resources and prevent legitimate requests from completing. It was published on September 7, 2026, with a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, GitHub Advisory DB).

The root cause is inefficient algorithmic complexity (CWE-407, CWE-1050) in two code paths within AttributesExtension. First, AttributesListener::processDocument() calls AttributesHelper::mergeAttributes() and AttributesHelper::filterAttributes() on the full accumulated attribute set for each new attribute node, resulting in O(n²) complexity when n attributes share a common target (affected from version 1.5.0). Second, AttributesBlockContinueParser::tryContinue() similarly rebuilds the entire accumulated attribute set on each continuation line (affected from version 2.0.0). Concrete benchmarks show 256 KB of adjacent inline attributes taking 20.0 seconds to process on the vulnerable version versus 0.09 seconds on the patched version, and 256 KB of consecutive attribute-block lines taking 1.9 seconds versus 0.08 seconds patched. This vulnerability is related to the previously patched GHSA-jjv6-8j6v-6j52 (fixed in 2.9.1), which only addressed the class attribute but left all other attribute names on the vulnerable code path (GitHub Advisory).

Successful exploitation causes high availability impact by exhausting PHP worker CPU resources, rendering the application unresponsive to legitimate requests. The vulnerability has no confidentiality or integrity impact — rendered output is unchanged and no data is disclosed. Only applications that explicitly register AttributesExtension on the Environment are affected; the default CommonMarkConverter, GithubFlavoredMarkdownConverter, and GithubFlavoredMarkdownExtension are not vulnerable (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory DB). The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any network-accessible attacker against affected deployments. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

1. Reconnaissance: Identify web applications that accept user-supplied Markdown input and use league/commonmark versions 1.5.0–2.9.2 with AttributesExtension explicitly registered.
2. Craft malicious payload: Construct a Markdown document containing a large number of distinctly-named inline attributes targeting a common block, e.g., {a0="v"}{a1="v"}{a2="v"}… repeated to fill ~256 KB, or consecutive attribute-block lines {a0=v}\n{a1=v}\n{a2=v}\n….
3. Submit payload: Send the crafted Markdown document to the application's Markdown processing endpoint via an HTTP POST request (no authentication required).
4. Trigger quadratic processing: The server's PHP process enters O(n²) attribute merging and filtering, consuming disproportionate CPU time (up to ~20 seconds per 256 KB request).
5. Achieve denial of service: Repeat requests to sustain CPU exhaustion, occupying all available PHP workers and preventing legitimate users from receiving responses (GitHub Advisory).

• Network: Repeated HTTP POST requests to Markdown-processing endpoints with large payloads (~256 KB or more) containing patterns of numerous distinct attribute names (e.g., {a0=, {a1=, {a2= sequences).
• Logs: Web server access logs showing high-frequency requests to Markdown input endpoints from a single or small set of IP addresses; PHP-FPM or web server logs showing requests with abnormally long processing times (>5 seconds) for Markdown conversion endpoints.
• Process: PHP worker processes sustaining near-100% CPU utilization for extended periods; PHP process pool exhaustion visible in PHP-FPM status pages or system monitoring tools.
• Application: Increased rate of request timeouts or 503/504 errors from the application coinciding with large Markdown submission requests (GitHub Advisory).

Upgrade league/commonmark to version 2.10.0 or later, which fixes both vulnerable code paths by processing each attribute node or continuation line in constant time rather than re-merging and re-filtering the entire accumulated set. If an immediate upgrade is not possible, the primary workaround is to not register AttributesExtension when processing untrusted Markdown input. If the extension is required, enforce a strict maximum input length before conversion (noting that the quadratic cost means the cap must be small to meaningfully bound worst-case CPU time). Additional mitigations include rate limiting Markdown processing endpoints, applying PHP execution time limits, and restricting Markdown submission to trusted users — though none of these are substitutes for upgrading (GitHub Advisory).