CVE-2024-58382: league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-09 · updated 2026-10-27
Weakness: CWE-407

Description

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.

Affected products

thephpleague commonmark: before 2.6.0 — fixed in 2.6.0

How to fix

Upgrade to a fixed version: thephpleague commonmark 2.6.0. Check the vendor advisory for mitigations.

References

https://github.com/thephpleague/commonmark/security/advisories/GHSA-c2pc-g5qf-rfrf
https://www.vulncheck.com/advisories/league-commonmark-before-2.6.0-denial-of-service-via-quadratic-complexity

Get alerted when CVE-2024-58382 or the next vulnerability affects your stack