CVE-2024-58382: Inefficient Algorithmic Complexity in thephpleague commonmark
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
AI Analysis
Technical Summary
CVE-2024-58382 is a high-severity vulnerability in thephpleague commonmark prior to version 2.6.0. It stems from polynomial time complexity in the Markdown parsing algorithm, enabling attackers to trigger worst-case performance scenarios. By submitting specially crafted Markdown content, attackers can cause denial of service by overloading CPU and PHP-FPM resources. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network.
Potential Impact
Successful exploitation results in denial of service by exhausting CPU and PHP-FPM processes, potentially causing service outages or degraded performance. There is no indication of data compromise or privilege escalation from the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing rate limiting or input validation to mitigate the impact of crafted Markdown inputs.
CVE-2024-58382: Inefficient Algorithmic Complexity in thephpleague commonmark
Description
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-58382 is a high-severity vulnerability in thephpleague commonmark prior to version 2.6.0. It stems from polynomial time complexity in the Markdown parsing algorithm, enabling attackers to trigger worst-case performance scenarios. By submitting specially crafted Markdown content, attackers can cause denial of service by overloading CPU and PHP-FPM resources. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network.
Potential Impact
Successful exploitation results in denial of service by exhausting CPU and PHP-FPM processes, potentially causing service outages or degraded performance. There is no indication of data compromise or privilege escalation from the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing rate limiting or input validation to mitigate the impact of crafted Markdown inputs.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-16T13:02:14.691Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa16126acd9273b49645a5b
Added to database: 09/09/2026, 13:37:42 UTC
Last enriched: 09/09/2026, 13:52:30 UTC
Last updated: 09/09/2026, 21:52:41 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.