Skip to content
Heist/ feed
High

league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

Type: advisorySource: Official CVE List1 source record

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.

Announced Source revision 1
Original source ↗

CVE-2024-58382

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-58382

commonmark

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "thephpleague",
    "product": "commonmark",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.6.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "2.6.0",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:composer/league/commonmark",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2024-58382

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#12620 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement