Executive brief
The league/commonmark library, a popular PHP tool for converting Markdown text to other formats, is vulnerable to a denial-of-service attack when generating XML output. An attacker can provide a specially crafted Markdown file with deeply nested structures that causes the library to consume excessive memory and produce an extremely large output file. This can lead to server performance degradation or crashes, potentially impacting the availability of services that process user-supplied Markdown.
Technical details
The XmlRenderer component in league/commonmark (versions 2.x before 2.9.0) performs pretty-printing by emitting indentation whitespace proportional to the depth of every opening and closing tag. This results in O(n²) output size and memory consumption relative to the tree depth (n). An attacker can exploit this by submitting Markdown with deeply nested blockquotes or other structures, leading to asymmetric resource consumption (CWE-405). While the parser has a 'max_nesting_level' setting, its default value is high enough to allow for significant resource amplification. The issue is fixed in version 2.9.0.
Affected products
- thephpleague commonmark >= 2.0.0, < 2.9.0
Timeline
- 2026-08-03: disclosed: Initial report to thephpleague/commonmark
- 2026-08-06: advisory: GitHub Advisory GHSA-mj63-m3rc-8ppr published
- 2026-08-06: patched: Version 2.9.0 released
References
- https://api.github.com/users/GrahamCampbell
- https://github.com/GrahamCampbell
- https://api.github.com/users/GrahamCampbell/gists%7B/gist_id%7D
- https://api.github.com/users/GrahamCampbell/repos
- https://avatars.githubusercontent.com/u/2829600?v=4
- https://api.github.com/users/GrahamCampbell/events%7B/privacy%7D