CVE-2024-58382: high-severity vulnerability in thephpleague commonmark
league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.5%
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
thephpleague · commonmarkRelated CVEs — thephpleague commonmark
In the same product, most dangerous first.
CVE-2026-71488HIGHleague/commonmark: Quadratic-time denial of service when parsing crafted MarkdownEPSS 0.6%CVE-2026-86429HIGHcommonmark before 2.9.1 Denial of Service via SmartPunct and AttributesEPSS 0.5%CVE-2026-86434HIGHcommonmark 2.0.0 through 2.8.3 Denial of Service via Slug CollisionEPSS 0.5%CVE-2026-86433HIGHcommonmark 1.5.0 before 2.8.4 Denial of Service via AttributesEPSS 0.5%CVE-2026-86430HIGHleague/commonmark before 2.9.1 Denial of Service via parsingEPSS 0.5%CVE-2026-86428HIGHcommonmark 1.5.0 before 2.10.0 Denial of Service via AttributesEPSS 0.5%