CVE-2024-58382

Deferred Deferred - Pending Action

Denial of Service in CommonMark via Worst-Case Markdown Parsing

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: VulnCheck

Description

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2024-58382

EUVD

EUVD-2024-55755

Affected Vendors & Products

Vendor	Product	Version / Range
league	commonmark	to 2.6.0 (exc)
thephpleague	commonmark	to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

CVE-2024-58382 is a denial of service vulnerability in league/commonmark versions before 2.6.0 caused by polynomial or quadratic time complexity in Markdown parsing. Attackers can submit crafted Markdown inputs designed to trigger worst-case performance, consuming excessive CPU and PHP-FPM resources. Multiple parallel requests amplify the impact, leading to service denial for legitimate users.

Detection Guidance

Check if your system uses league/commonmark versions before 2.6.0 by running: composer show league/commonmark. If the version is below 2.6.0, the system is vulnerable. Monitor for high CPU usage or slow responses during Markdown processing as potential indicators of exploitation.

Impact Analysis

If you use league/commonmark before version 2.6.0, this vulnerability could allow attackers to slow down or crash your application by sending specially crafted Markdown inputs. This may result in high CPU usage, slow response times, or complete unavailability of services relying on the library.

Compliance Impact

This vulnerability primarily causes denial of service by exhausting CPU and PHP-FPM resources through crafted Markdown inputs. It does not directly impact data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, prolonged service disruption could indirectly affect compliance by impairing system availability required for processing personal or health data.

Mitigation Strategies

Upgrade league/commonmark to version 2.6.0 or later immediately. As temporary measures, lower PHP memory limits, reduce execution time, implement rate-limiting, restrict input sizes, or limit library access to trusted users only.

Hi! I’m here to help you understand CVE-2024-58382. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70