GHSA-MJ63-M3RC-8PPR: GHSA-MJ63-M3RC-8PPR: Quadratic-Time Complexity in league/commonmark XML Pretty-Printing

#security #cve #cybersecurity #ghsa

GHSA-MJ63-M3RC-8PPR: Quadratic-Time Complexity in league/commonmark XML Pretty-Printing

Vulnerability ID: GHSA-MJ63-M3RC-8PPR
CVSS Score: 5.3
Published: 2026-08-06

A Denial of Service vulnerability exists in the league/commonmark package for PHP when using the XML rendering subsystem. Due to unconstrained indentation based on AST depth, rendering deeply nested elements leads to asymmetric resource consumption (quadratic output size complexity).

TL;DR

Unconstrained XML indentation allows remote attackers to trigger quadratic CPU and memory exhaustion by supplying deeply nested Markdown input.

Technical Details

CWE ID: CWE-405
Attack Vector: Network (AV:N)
CVSS Score: 5.3 (Medium)
Vulnerability Type: Denial of Service (DoS)
Exploit Status: None
CISA KEV Status: Not Listed

Affected Systems

league/commonmark
league/commonmark: >= 2.0.0, < 2.9.0 (Fixed in: 2.9.0)

Code Analysis

Commit: b5ac8c3

Cap XmlRenderer indentation depth (GHSA-mj63-m3rc-8ppr)

Mitigation Strategies

Upgrade league/commonmark to version 2.9.0 or higher
Decrease the max_nesting_level configuration parameter to 50 or less
Implement a strict length limit on untrusted input strings before parsing
Disable XML pretty-printing by setting xml/max_indentation_level to 0 in environment settings

Remediation Steps:

Identify all Composer dependencies referencing league/commonmark
Run 'composer update league/commonmark' to fetch version 2.9.0 or higher
Verify the application configuration and adjust max_nesting_level if needed
Deploy the updated vendor code to staging and production environments

References

Read the full report for GHSA-MJ63-M3RC-8PPR on our website for more details including interactive diagrams and full exploit analysis.

DEV Community