CVE-2024-58382
league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
- Record
CVE-2024-58382- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-02
EUVDEUVD-2024-55755
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
- Record
EUVD-2024-55755- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c2pc-g5qf-rfrf
league/commonmark's quadratic complexity bugs may lead to a denial of service
Impact
Several polynomial time complexity issues in league/commonmark may lead to unbounded resource exhaustion and subsequent denial of service.
Malicious users could trigger that inefficient code with carefully crafted Markdown inputs that are specifically designed to ensure the worst-case performance is reached. Sending multiple such requests in parallel could tie up all available CPU resources and/or PHP-FPM processes, leading to denial of service for legitimate users.
Patches
These vulnerabilities have been patched in version 2.6.0. All users on older versions are highly encouraged to upgrade as soon as possible.
Workarounds
If you cannot upgrade, you may be able to mitigate the issues by:
- Setting very low
memory_limitandmax_execution_timePHP configurations to prevent runaway resource usage - Implementing rate-limiting, bot protection, or other approaches to reduce the risk of simultaneous bad requests hitting your site
- Limiting the size of inputs fed into this library (specifically the max length of each line)
- Limiting the use of this library to trusted users
References
Most of these issues were discovered in other Markdown parsers. You can read more about them here:
- https://github.com/commonmark/commonmark.js/issues/129
- https://github.com/commonmark/commonmark.js/issues/157
- https://github.com/commonmark/commonmark.js/issues/172
- https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p
- https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r
- https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c
- https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5
- https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5
- https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
For general information about this type of issue:
- Record
GHSA-c2pc-g5qf-rfrf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fv22-86fq-c33q
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in...
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
- Record
GHSA-fv22-86fq-c33q- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-02
NVD
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
- Record
CVE-2024-58382- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-02
OSV
league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
- Record
CVE-2024-58382- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-407
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-58382
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
- Record
DEBIAN-CVE-2024-58382- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVGHSA-c2pc-g5qf-rfrf
league/commonmark's quadratic complexity bugs may lead to a denial of service
Impact
Several polynomial time complexity issues in league/commonmark may lead to unbounded resource exhaustion and subsequent denial of service.
Malicious users could trigger that inefficient code with carefully crafted Markdown inputs that are specifically designed to ensure the worst-case performance is reached. Sending multiple such requests in parallel could tie up all available CPU resources and/or PHP-FPM processes, leading to denial of service for legitimate users.
Patches
These vulnerabilities have been patched in version 2.6.0. All users on older versions are highly encouraged to upgrade as soon as possible.
Workarounds
If you cannot upgrade, you may be able to mitigate the issues by:
- Setting very low
memory_limitandmax_execution_timePHP configurations to prevent runaway resource usage - Implementing rate-limiting, bot protection, or other approaches to reduce the risk of simultaneous bad requests hitting your site
- Limiting the size of inputs fed into this library (specifically the max length of each line)
- Limiting the use of this library to trusted users
References
Most of these issues were discovered in other Markdown parsers. You can read more about them here:
- https://github.com/commonmark/commonmark.js/issues/129
- https://github.com/commonmark/commonmark.js/issues/157
- https://github.com/commonmark/commonmark.js/issues/172
- https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p
- https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r
- https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c
- https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5
- https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5
- https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh
For general information about this type of issue:
- Record
GHSA-c2pc-g5qf-rfrf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-407
- Updated
- 2026-11-02
OSVCLSA-2025-1766364770 No score
TuxCare security update for league/commonmark (1 CVE)
TuxCare rebuilt league/commonmark to address 1 CVE. Fixed in 1.6.7-p1+tuxcare.
- Record
CLSA-2025-1766364770- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
league/commonmarkPackagist |
before 2.6.0 | 2.6.0 |
league/commonmarkTuxCare:Packagist |
1.6.7 up to 1.6.7-p1+tuxcare | 1.6.7-p1+tuxcare |
php-league-commonmarkDebian:12 |
All versions, plus listed versions 2.10.0-12.10.1-12.10.3-12.10.4-12.3.9-1 Show 21 moreShow less2.3.9-1+deb12u12.4.0-12.4.1-12.4.2-12.4.2-22.5.0-12.5.1-12.5.3-12.6.0-12.6.1-12.6.1-22.6.2-12.7.0-12.7.1-12.7.1-22.8.0-12.8.1-12.8.2-12.8.2-22.8.3-12.9.0-1 |
None known |
php-league-commonmarkDebian:13 |
before 2.6.0-1 | 2.6.0-1 |
php-league-commonmarkDebian:14 |
before 2.6.0-1 | 2.6.0-1 |
league/commonmarkPackagist |
before 2.6.0, plus listed versions 0.1.00.1.10.1.20.10.00.11.0 Show 45 moreShow less0.11.10.11.20.11.30.12.00.13.00.13.10.13.20.13.30.13.40.14.00.15.00.15.10.15.20.15.30.15.40.15.50.15.60.15.70.16.00.17.00.17.10.17.20.17.30.17.40.17.50.18.00.18.10.18.20.18.30.18.40.18.50.19.00.19.10.19.20.19.30.2.00.2.10.3.00.4.00.5.00.5.10.6.00.6.10.7.00.7.1 |
2.6.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-58382 is a high vulnerability (CVSS 8.7) in Thephpleague Commonmark, published December 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in league/commonmark 2.6.0.
References
github.com/thephpleague/commonmark/security/advisories/GHSA-c2pc-g5qf-rfrf
vulncheck.com/advisories/league-commonmark-before-2.6.0-denial-of-service-via-quadratic-complexity
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-58382
security-tracker.debian.org/tracker/CVE-2024-58382
Left out here: 81 versions. The JSON record has them.