CVE-2026-86430: thephpleague commonmark

csirt@kutim:~/threat-intel/cve/CVE-2026-86430

CVSS 7.5 · High EPSS 0,49%

Kerentanan Inefficient Algorithmic Complexity pada thephpleague commonmark. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.

Rincian

Terbit di NVD: 7 September 2026
Terakhir diubah: 8 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-407: Inefficient Algorithmic Complexity
EPSS (30 hari): 0,49% peluang dieksploitasi; lebih tinggi dari 40,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
thephpleague	commonmark	Semua versi sebelum 2.9.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/thephpleague/commonmark/security/advisories/GHSA-j8pm-gj4c-rq4x mitigasi · patch · advisory vendor
https://www.vulncheck.com/advisories/league-commonmark-before-2.9.1-denial-of-service-via-parsing advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 06:25 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.