CVE-2026-86434

Name of the Vulnerable Software and Affected Versions league/commonmark versions 2.0.0 through 2.8.3

Description A denial of service issue exists in the UniqueSlugNormalizer::normalize() function. The problem occurs when the function restarts its numeric-suffix search from 1 during every slug collision, leading to O(K^2) time complexity for K headings that collapse to the same base slug. This path is triggered when the HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can provide a small Markdown document containing many headings that resolve to a single base slug, such as identical heading text, punctuation-only headings, or empty ATX headings, resulting in excessive CPU consumption.

Recommendations Update to version 2.9.0. As a temporary mitigation, avoid registering the HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension modules.