CVE-2024-58382

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-58382
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58382.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-58382
Aliases
Published
2026-09-09T13:31:56Z
Modified
2026-09-10T03:45:29Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
Details

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58382.json"
}
References

Affected packages

Git / github.com/thephpleague/commonmark

Affected ranges

Type
GIT
Repo
https://github.com/thephpleague/commonmark
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d150f911e0079e90ae3c106734c93137c184f932
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.6.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.10.0
0.11.0
0.11.1
0.11.2
0.11.3
0.12.0
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.14.0
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
0.16.0
0.17.0
0.17.2
0.17.4
0.18.1
0.2.0
0.2.1
0.3.0
0.4.0
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.9.0
2.*
2.0.0
2.0.0-beta1
2.0.0-beta2
2.0.0-beta3
2.0.0-rc1
2.0.0-rc2
2.0.1
2.0.2
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58382.json"