thephpleague commonmark denial of service in XmlRenderer

Severity: medium · CVSS 5.3 · Published 2026-08-06

The league/commonmark library, a popular PHP tool for converting Markdown text to other formats, is vulnerable to a denial-of-service attack when generating XML output. An attacker can provide a specially crafted Markdown file with deeply nested structures that causes the library to consume excessive memory and produce an extremely large output file. This can lead to server performance degradation or crashes, potentially impacting the availability of services that process user-supplied Markdown.

Technologies: league/commonmark (Packagist), The PHP League CommonMark. Vendors: Packagist, The PHP League.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 5.3, published 6 August 2026.
Which products and versions are affected?
league/commonmark (Packagist) >= 2.0.0, < 2.9.0; The PHP League CommonMark >= 2.0.0, < 2.9.0.
Is there a fix for This vulnerability?
A patch was published on 2026-08-06: Version 2.9.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run league/commonmark (Packagist) or The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The XmlRenderer component in league/commonmark (versions 2.x before 2.9.0) performs pretty-printing by emitting indentation whitespace proportional to the depth of every opening and closing tag. This results in O(n²) output size and memory consumption relative to the tree depth (n). An attacker can exploit this by submitting Markdown with deeply nested blockquotes or other structures, leading to asymmetric resource consumption (CWE-405). While the parser has a 'max_nesting_level' setting, its default value is high enough to allow for significant resource amplification. The issue is fixed in version 2.9.0.

Affected products

  • thephpleague commonmark >= 2.0.0, < 2.9.0

Timeline

  • 2026-08-03: disclosed: Initial report to thephpleague/commonmark
  • 2026-08-06: advisory: GitHub Advisory GHSA-mj63-m3rc-8ppr published
  • 2026-08-06: patched: Version 2.9.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.