commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension. The vulnerability arises from a failure to deduplicate footnote definitions, allowing attackers to craft malicious documents with duplicate footnote definitions and references. This causes quadratic output expansion, leading to excessive memory and CPU consumption. The attack can exhaust server resources, effectively causing a denial of service. The vulnerability affects the PHP League's commonmark library and has been assigned CVE-2026-86435. A fix is available in version 2.8.4 and later. Users are advised to upgrade to the patched version to mitigate the risk.