commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming disproportionate CPU resources and preventing legitimate requests from completing.

CVE-2026-86428 affects the commonmark PHP library versions 1.5.0 through before 2.10.0. The vulnerability exists in the AttributesExtension component, which fails to efficiently handle Markdown input containing numerous distinctly-named attributes. Attackers can craft malicious Markdown payloads with many unique attribute names to trigger quadratic-time complexity during attribute merging and filtering operations. This results in excessive CPU consumption, effectively causing a denial of service condition. Legitimate requests are prevented from completing while the server processes the malicious input. The issue is classified as a denial of service vulnerability with a high criticality rating. Users are advised to upgrade to commonmark version 2.10.0 or later to remediate the vulnerability. The flaw was disclosed via GitHub Security Advisories and VulnCheck.