CVE-2026-86432
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Sep 07, 2026
Vendor
unknown
Description
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentation for every XML tag. Attackers can provide deeply nested Markdown or AST structures to cause quadratic memory consumption and output amplification, exhausting server resources.