# CVE-2026-86432: commonmark XmlRenderer denial of service via nested XML indentation

Source: https://junglewise.ai/threats/cve-2026-86432-commonmark-xmlrenderer-denial-of-service-via-nested-xml  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86432 · Severity: medium · CVSS 5.3 · Published 2026-09-07

The commonmark library is a popular Markdown-to-XML converter used by web applications to process user-supplied content. A flaw in its XML rendering feature causes quadratic memory consumption when processing deeply nested Markdown structures, allowing attackers to exhaust server resources through a single request containing nested blockquotes or crafted AST trees.

Technologies: [The PHP League CommonMark](https://junglewise.ai/threats/technologies/commonmark). Vendors: [The PHP League](https://junglewise.ai/threats/vendors/the-php-league).

## Quick answers

**Is CVE-2026-86432 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86432 being exploited in the wild.

**How severe is CVE-2026-86432?** Medium severity, with a CVSS score of 5.3, published 7 September 2026.

**Which products and versions are affected?** The PHP League CommonMark 2.0.0 to 2.8.3.

**Is there a fix for CVE-2026-86432?** A patch was published on 2026-09-07: Version 2.9.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86432 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86432?** Check whether you run The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The XmlRenderer component in commonmark emits indentation whitespace proportional to tree depth for every XML tag opening and closing, resulting in O(n²) bytes of memory and output for a tree of depth n. Attackers can trigger this through the MarkdownToXmlConverter with deeply nested Markdown (e.g. repeated blockquotes via str_repeat('> ', $depth)) or by passing a malicious AST directly to XmlRenderer::renderDocument(). The parser's max_nesting_level configuration can bound parser-generated trees but does not constrain programmatically built ASTs, and the default limit is high enough to reach damaging sizes. This amplification vulnerability affects all versions from 2.0.0 through 2.8.3; version 2.9.0 patches the issue. The HTML renderer does not emit depth-proportional indentation and is not vulnerable.

## Affected products

- The PHP League commonmark 2.0.0 to 2.8.3

## Timeline

- 2026-08-03: disclosed
- 2026-09-07: patched: Version 2.9.0 released

## References

- [https://github.com/thephpleague/commonmark/security/advisories/GHSA-mj63-m3rc-8ppr](https://github.com/thephpleague/commonmark/security/advisories/GHSA-mj63-m3rc-8ppr)
- [https://www.vulncheck.com/advisories/commonmark-2.0.0-before-2.8.4-denial-of-service-via-xml](https://www.vulncheck.com/advisories/commonmark-2.0.0-before-2.8.4-denial-of-service-via-xml)

## Related threats

- [league/commonmark polynomial time complexity denial of service](https://junglewise.ai/threats/cve-2024-58382-league-commonmark-polynomial-time-complexity-denial-of-service)
- [commonmark Footnote extension denial of service](https://junglewise.ai/threats/cve-2026-86435-commonmark-footnote-extension-denial-of-service)
- [league commonmark quadratic-time denial of service in Markdown parsing](https://junglewise.ai/threats/cve-2026-71488-league-commonmark-quadratic-time-denial-of-service-in-markdown)
- [thephpleague commonmark XSS bypass in AttributesExtension](https://junglewise.ai/threats/cve-2026-71478-thephpleague-commonmark-xss-bypass-in-attributesextension)
- [thephpleague commonmark denial of service in XmlRenderer](https://junglewise.ai/threats/thephpleague-commonmark-denial-of-service-in-xmlrenderer-99533992)