The vulnerability exists in the XmlRenderer component of thephpleague/commonmark, affecting versions 2.0.0 through 2.8.3. The renderer generates depth‑proportional indentation for each XML tag it processes. An attacker can supply deeply nested Markdown or abstract syntax tree structures, forcing the renderer to allocate memory quadratic in the depth of nesting and produce output that shares the same nested structure. This can exhaust server memory and CPU resources, leading to denial of service.

Affected systems include all deployments of thephpleague/commonmark 2.0.0‑2.8.3. The library is used by PHP applications that import CommonMark for Markdown parsing or rendering to XML. Any installation of a library within that range is vulnerable; no sub‑version details are provided beyond the range.

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, so the current exploitation probability is unknown; however, the deterministic nature of the misbehavior makes success likely when an attacker can feed crafted input. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to supply user‑generated Markdown or AST content that the renderer processes, which could occur through any endpoint that accepts markdown for XML output. In environments where the renderer is exposed to untrusted input, the risk of resource exhaustion is significant.