# GHSA-mj63-m3rc-8ppr: league/commonmark: Denial of service via deeply nested XML output

> Attackers can cause denial of service via memory exhaustion by submitting deeply nested Markdown to applications using the opt-in XML renderer.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 6 Aug 2026

## What is GHSA-mj63-m3rc-8ppr?

GHSA-mj63-m3rc-8ppr is a denial of service vulnerability in league/commonmark, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Impact

`XmlRenderer` pretty-prints XML by emitting depth-proportional indentation whitespace for **every** opening and closing tag. For a tree of depth n, the indentation alone sums to **O(n²)** bytes of output (and corresponding memory), reachable through `MarkdownToXmlConverter` — e.g. `str_repeat('> ', $depth) . "x\n"`, a single line of nested blockquotes — or through a direct `XmlRenderer::renderDocument()` call on an attacker-influenced AST.

This affects applications that convert untrusted Markdown to XML, which is an **opt-in** output path. The parser's `max_nesting_level` bounds the depth of *parser-created* trees, but its default is high enough to reach damaging sizes, can be raised by the host application, and does not constrain custom or programmatically built ASTs handed straight to the renderer. The result is a memory / output-size amplification rather than a hard crash, which is why this issue is rated **Medium** rather than High. No confidentiality or integrity impact. XML rendering was introduced in 2.0.0 (first shipped in 2.0.0-beta1, June 2021) and has emitted depth-proportional indentation ever since, so all 2.x releases are affected (verified against 2.8.x, clean upstream `1902f60f`). 1.x has no XML renderer and is not affected.

### Workarounds

Applications converting untrusted Markdown to XML should:

- **Lower `max_nesting_level`** to a conservative value appropriate to expected content, so the parser refuses to build extremely deep trees. This is the most direct lever for parser-produced ASTs, but does not protect trees built programmatically and passed straight to `XmlRenderer`.
- **Cap input size before conversion**, since the amplification is driven by input-proportional depth.
- **Constrain XML consumers** with memory / output-size limits (and streaming or size caps on any downstream XML parser or storage) so one request cannot allocate unbounded output.
- **Prefer HTML rendering** for untrusted content where XML is not strictly required — the HTML renderer does not emit depth-proportional indentation and is not subject to this amplification.

## Which versions are affected by GHSA-mj63-m3rc-8ppr?

2 open source packages ship an affected version, including league/commonmark.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `league/commonmark` | Packagist | From 2.0.0 | 2.9.0 |
| `league/commonmark` | Packagist | From 2.0.0 | 2.9.0 |

## How do I fix GHSA-mj63-m3rc-8ppr?

Upgrade league/commonmark to 2.9.0 or later.

## Is GHSA-mj63-m3rc-8ppr being exploited?

There is no known exploitation of GHSA-mj63-m3rc-8ppr in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-mj63-m3rc-8ppr and fix it if it is affected.

What it is: GHSA-mj63-m3rc-8ppr is a denial of service vulnerability in league/commonmark, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-mj63-m3rc-8ppr in the wild and no public exploit code.

Affected packages and fixed versions:
- league/commonmark (Packagist): affected from 2.0.0; fixed in 2.9.0
- league/commonmark (Packagist): affected from 2.0.0; fixed in 2.9.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-mj63-m3rc-8ppr/ (Markdown: https://insights.sbomify.com/GHSA-mj63-m3rc-8ppr/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-mj63-m3rc-8ppr

---
From sbomify Insights: https://insights.sbomify.com/GHSA-mj63-m3rc-8ppr/
Summaries are generated and may contain mistakes; the official description above is the record.