High severity · published Sep 9, 2026
CVE-2024-58382
league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
commonmark · thephpleague
before 2.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-58382
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-58382
vendor-advisory
https://github.com/thephpleague/commonmark/security/advisories/GHSA-c2pc-g5qf-rfrf
third-party-advisory
https://www.vulncheck.com/advisories/league-commonmark-before-2.6.0-denial-of-service-via-quadratic-complexity
More from commonmark
7.5
CVE-2026-105830
league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser
7.5
CVE-2026-86435
commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
7.5
CVE-2026-86434
commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
7.5
CVE-2026-86433
commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
7.5
CVE-2026-86430
league/commonmark before 2.9.1 Denial of Service via parsing