Asymmetric Resource Consumption (Amplification) Affecting league/commonmark package, versions >=2.0.0, <2.9.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-LEAGUECOMMONMARK-18600657
- published9 Aug 2026
- disclosed6 Aug 2026
- creditUnknown
Introduced: 6 Aug 2026
New CVE NOT AVAILABLE CWE-405 (opens in a new tab)How to fix?
Upgrade league/commonmark to version 2.9.0 or higher.
Overview
league/commonmark is a PHP-based Markdown parser which supports the full CommonMark spec. It is based on the CommonMark JS reference implementation.
Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) via the XmlRenderer process. An attacker can cause excessive memory and output size consumption by providing deeply nested input structures, leading to resource exhaustion. This is only exploitable if the application converts untrusted Markdown to XML, especially when custom or programmatically built ASTs are passed directly to the renderer without adequate depth restrictions.
Workaround
This vulnerability can be mitigated by lowering the max_nesting_level to a conservative value, capping input size before conversion, constraining XML consumers with memory/output-size limits, or preferring HTML rendering for untrusted content.