{"vulnerability": "GHSA-mj63-m3rc-8ppr", "sightings": [{"uuid": "7a7f93c0-fab2-402a-896d-48ee83afeb7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-MJ63-M3RC-8PPR", "type": "seen", "source": "https://gist.github.com/alon710/b81b5b8f072a27c4fa74e05558afb769", "content": "# GHSA-MJ63-M3RC-8PPR: GHSA-MJ63-M3RC-8PPR: Quadratic-Time Complexity in league/commonmark XML Pretty-Printing\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/GHSA-MJ63-M3RC-8PPR\n\n## Summary\nA Denial of Service vulnerability exists in the league/commonmark package for PHP when using the XML rendering subsystem. Due to unconstrained indentation based on AST depth, rendering deeply nested elements leads to asymmetric resource consumption (quadratic output size complexity).\n\n## TL;DR\nUnconstrained XML indentation allows remote attackers to trigger quadratic CPU and memory exhaustion by supplying deeply nested Markdown input.\n\n## Technical Details\n\n- **CWE ID**: CWE-405\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Vulnerability Type**: Denial of Service (DoS)\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- league/commonmark\n- **league/commonmark**: >= 2.0.0, < 2.9.0 (Fixed in: `2.9.0`)\n\n## Mitigation\n\n- Upgrade league/commonmark to version 2.9.0 or higher\n- Decrease the max_nesting_level configuration parameter to 50 or less\n- Implement a strict length limit on untrusted input strings before parsing\n- Disable XML pretty-printing by setting xml/max_indentation_level to 0 in environment settings\n\n**Remediation Steps:**\n1. Identify all Composer dependencies referencing league/commonmark\n2. Run 'composer update league/commonmark' to fetch version 2.9.0 or higher\n3. Verify the application configuration and adjust max_nesting_level if needed\n4. Deploy the updated vendor code to staging and production environments\n\n## References\n\n- [GitHub Security Advisory GHSA-mj63-m3rc-8ppr](https://github.com/thephpleague/commonmark/security/advisories/GHSA-mj63-m3rc-8ppr)\n- [Cap XmlRenderer indentation depth Commit b5ac8c3](https://github.com/thephpleague/commonmark/commit/b5ac8c3947ca81844e85a09c7e0a5b4148bde2e1)\n- [league/commonmark Release v2.9.0](https://github.com/thephpleague/commonmark/releases/tag/2.9.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-MJ63-M3RC-8PPR) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T12:34:21.417686Z"}]}