The XmlRenderer in league/commonmark pretty-prints XML by emitting indentation proportional to the depth of each opening and closing tag, resulting in O(n²) output size and memory usage for a tree of depth n. This can be exploited by providing deeply nested Markdown content or attacker-controlled ASTs to cause denial of service through resource exhaustion. The parser's max_nesting_level setting limits parser-generated trees but does not constrain programmatically built ASTs passed directly to the renderer. This issue affects all 2.x releases starting from 2.0.0 (including 2.0.0-beta1) through versions before 2.9.0. The vulnerability does not affect 1.x versions, which lack XML rendering. The impact is limited to availability (memory/output size amplification) without confidentiality or integrity compromise. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

This vulnerability can cause denial of service by consuming excessive memory and producing very large output when rendering deeply nested XML from untrusted Markdown input or attacker-influenced ASTs. There is no confidentiality or integrity impact. The resource exhaustion arises from the quadratic growth of indentation whitespace with XML tree depth, potentially leading to application slowdown or crash due to memory exhaustion.

A patch is available for this vulnerability. Applications converting untrusted Markdown to XML should lower the max_nesting_level parser setting to a conservative value to limit tree depth, cap input size before conversion, and constrain XML consumers with memory or output size limits. Prefer HTML rendering for untrusted content when XML output is not strictly required, as the HTML renderer does not exhibit this amplification. Since the vulnerability affects programmatically built ASTs passed directly to XmlRenderer, additional input validation or limiting such usage is recommended.