league/commonmark EUVD-2026-72390

Exploitation requires the target application to route untrusted Markdown input through the opt-in XmlRenderer or MarkdownToXmlConverter code path - this is not the default rendering mode in league/commonmark (the default is HtmlRenderer). Applications using only HTML rendering are entirely unaffected. When the XmlRenderer path does accept untrusted input, no authentication or elevated privileges are required; the attack is fully network-accessible and the payload is trivial to construct. Impact depth is further bounded by the max_nesting_level parser setting (default allows substantial depth) for parser-produced ASTs, but applications that construct ASTs programmatically and pass them directly to XmlRenderer::renderDocument() have no such bound. What limits exploitation: the opt-in nature of XmlRenderer is the primary limiting factor; impact is gradual resource exhaustion rather than an immediate crash, requiring sustained or repeated requests to achieve denial of service.

The CVSS 4.0 score of 6.9 with VA:L reflects the limited but real blast radius: no confidentiality or integrity exposure, and an availability impact that manifests as gradual resource exhaustion rather than an immediate hard crash, which is why the GHSA advisory rates this Medium rather than High. The network-reachable, unauthenticated, low-complexity attack surface (AV:N/AC:L/PR:N/UI:N) means any exposed endpoint is trivially targetable, but the vendor's use of AT:N in the 4.0 vector arguably overstates universality - XmlRenderer is an opt-in path, not the default, which meaningfully limits the affected deployment population. Repeated moderate-depth payloads rather than a single maximum-depth request could be sufficient for sustained resource pressure; even a mid-sized PHP CMS operator in tczew that exposes Markdown-to-XML conversion for documentation or content workflows should assess whether that endpoint receives untrusted input before dismissing this as low priority. No EPSS score or CISA KEV listing is present in the available data, so exploitation likelihood and active exploitation status cannot be independently confirmed; no public exploit code has been identified at time of analysis.

An attacker submits a single crafted HTTP POST containing thousands of levels of nested Markdown blockquotes (e.g., str_repeat('> ', 5000) . "x") to an application endpoint that passes Markdown through MarkdownToXmlConverter. The XmlRenderer allocates O(n²) memory generating the indented XML output; with repeated requests the server exhausts available PHP memory or output buffer limits, causing request failures or process crashes that deny service to legitimate users.