Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2024-58382 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/thephpleague/commonmark/security/advisories/GHSA-c2pc-g5qf-rfrf	[email protected]	AdvisoryRemedyVendor
https://www.vulncheck.com/advisories/league-commonmark-before-2.6.0-denial-of-service-via-quadratic-complexity	[email protected]	Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-407	Inefficient Algorithmic Complexity	[email protected]

Affected Products

Product	Versions
league/commonmark	< 2.6.0 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 2.6.0moderate effort Mitigation:low effort Set very low `memory_limit` and `max_execution_time` PHP configurations to prevent runaway resource usage. Mitigation:low effort Implement rate-limiting, bot protection, or other approaches to reduce the risk of simultaneous bad requests hitting your site. Mitigation:low effort Limit the size of inputs fed into this library (specifically the max length of each line). Mitigation:low effort Limit the use of this library to trusted users.

Product

Versions

league/commonmark

< 2.6.0 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 2.6.0moderate effort
Mitigation:low effort
Set very low `memory_limit` and `max_execution_time` PHP configurations to prevent runaway resource usage.
Mitigation:low effort
Implement rate-limiting, bot protection, or other approaches to reduce the risk of simultaneous bad requests hitting your site.
Mitigation:low effort
Limit the size of inputs fed into this library (specifically the max length of each line).
Mitigation:low effort
Limit the use of this library to trusted users.

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 9, 2026	CVE Modified	CISA-ADP
Sep 9, 2026	New CVE Received	[email protected]