---
id: CVE-2026-86435
title: >-
  commonmark versions from 1.5.0 before 2.8.4 contain a denial of service
  vulnerability in the Footnote extension that fails to deduplicate footnote
  definitions
summary: >-
  commonmark versions from 1.5.0 before 2.8.4 contain a denial of service
  vulnerability in the Footnote extension that fails to deduplicate footnote
  definitions. Attackers can craft documents with duplicate footnote definitions
  and referen…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-407
vendor: thephpleague
product: commonmark
affected:
  - commonmark >= 1.5.0 < 2.8.4
published: '2026-09-07'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T15:17:18.217'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86435'
references:
  - url: >-
      https://github.com/thephpleague/commonmark/security/advisories/GHSA-jfm3-95jq-q3rf
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/commonmark-1.5.0-before-2.8.4-denial-of-service-via-footnote
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-09T14:31:50.152312Z'
epss: 0.00488
epssPercentile: 0.39398
ingestedAt: '2026-09-08T20:10:03.179Z'
---

## Overview

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.