CVE-2026-86432: commonmark XmlRenderer DOS Vulnerability

CVE-2026-86432 Overview

CVE-2026-86432 is a denial of service vulnerability in the league/commonmark PHP library, affecting versions 2.0.0 through 2.8.3. The flaw resides in the XmlRenderer component, which emits depth-proportional indentation for every XML tag rendered from a Markdown Abstract Syntax Tree (AST). Attackers can submit deeply nested Markdown or AST structures to trigger quadratic memory consumption and output amplification. The resulting resource exhaustion can exhaust available memory on servers that render untrusted Markdown to XML. The vulnerability is categorized under CWE-405: Asymmetric Resource Consumption.

Critical Impact
Unauthenticated remote attackers can exhaust server memory and CPU by submitting deeply nested Markdown input to any endpoint invoking XmlRenderer.

Affected Products

league/commonmark versions 2.0.0 through 2.8.3
PHP applications rendering untrusted Markdown to XML via XmlRenderer
Downstream frameworks and CMS platforms bundling vulnerable commonmark releases

Discovery Timeline

2026-09-07 - CVE-2026-86432 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86432

Vulnerability Analysis

The XmlRenderer class in league/commonmark walks the parsed Markdown AST and serializes each node into XML. For every node, the renderer emits indentation whitespace proportional to the node's depth in the tree. When Markdown structures nest deeply, such as chained blockquotes or list items, the cumulative indentation grows quadratically relative to input size. A payload of N nested nodes generates output on the order of O(N²) bytes, with matching memory allocation during string construction.

The vulnerability requires no authentication and no user interaction. Any web-facing endpoint that accepts Markdown from untrusted sources and invokes XmlRenderer becomes exposed. Typical targets include comment systems, wiki engines, documentation portals, and API endpoints that transform Markdown into XML representations.

Root Cause

The root cause is unbounded output amplification in the XML rendering path. The renderer does not cap nesting depth, cumulative output size, or per-request memory allocation. Because indentation is recomputed and concatenated at each depth level, memory usage scales quadratically with input depth rather than linearly. This asymmetric resource consumption pattern is the hallmark of CWE-405.

Attack Vector

Exploitation is network-based. An attacker submits Markdown containing thousands of nested blockquote markers (>), nested list items, or a crafted AST that yields deep tree structures. When the server invokes XmlRenderer, memory allocation spikes and the PHP process may hit its memory_limit, terminate, or degrade service for concurrent requests. Refer to the GitHub Security Advisory and VulnCheck Denial of Service Advisory for technical details.

Detection Methods for CVE-2026-86432

Indicators of Compromise

Sudden PHP process termination with Allowed memory size exhausted errors in application logs
HTTP 500 responses correlated with Markdown-processing endpoints under low traffic volume
Request bodies containing long runs of repeated > characters, nested list markers, or unusually deep Markdown structures
Elevated CPU and memory usage on PHP-FPM workers handling comment, wiki, or API endpoints

Detection Strategies

Inspect web server access logs for POST requests with abnormally large payloads targeting Markdown endpoints
Deploy a Web Application Firewall (WAF) rule to flag inputs containing more than a threshold of consecutive block-quote or list-nesting characters
Monitor PHP error logs for E_ERROR entries referencing XmlRenderer.php or memory exhaustion during rendering

Monitoring Recommendations

Alert on process memory spikes exceeding baseline for PHP-FPM workers rendering user content
Track request latency for Markdown-to-XML endpoints and alert on sustained increases
Correlate application error rates with source IPs to identify probing or exploitation attempts

How to Mitigate CVE-2026-86432

Immediate Actions Required

Upgrade league/commonmark to version 2.8.4 or later using composer update league/commonmark
Audit all application code paths that instantiate XmlRenderer or process untrusted Markdown
Apply request size limits and PHP memory_limit boundaries on endpoints that accept Markdown input
Rate-limit anonymous submissions to Markdown-processing endpoints

Patch Information

The maintainers of thephpleague/commonmark released version 2.8.4 to remediate this vulnerability. Details are available in the GitHub Security Advisory GHSA-mj63-m3rc-8ppr. Applications should update the Composer dependency and redeploy affected services.

Workarounds

Avoid invoking XmlRenderer on untrusted Markdown; use HtmlRenderer where XML output is not required
Enforce a maximum input length on Markdown fields at the application or WAF layer
Reject inputs whose nesting depth exceeds a safe threshold before passing them to the renderer
Lower PHP memory_limit for worker processes handling public Markdown submissions to contain blast radius

bash

# Update commonmark to the patched release
composer require league/commonmark:^2.8.4
composer update league/commonmark

# Verify installed version
composer show league/commonmark | grep versions