commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources.

CVE-2026-86433 affects commonmark versions 1.5.0 through 2.8.4, exposing a denial of service vulnerability in the Attributes extension. The vulnerable function AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning, leading to algorithmic complexity issues. Unauthenticated attackers can exploit this by submitting approximately 32 KB of repeated attribute blocks to the parser. This input causes parsing operations to exceed 5 seconds, effectively exhausting server resources. The vulnerability requires no authentication, lowering the barrier for exploitation. Affected users should upgrade to commonmark version 2.8.4 or later to remediate the issue. The flaw is documented across NVD, GitHub Security Advisories, and VulnCheck.