CVE-2024-58382CWE-407

CVE-2024-58382

High · published September 9, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00278 · 19.2th percentile
Weakness
CWE-407 · Inefficient Algorithmic Complexity
Published
2026-09-09T18:17Z
References (2)
https://github.com/thephpleague/commonmark/security/advisories/GHSA-c2pc-g5qf-rfrf · [email protected]https://www.vulncheck.com/advisories/league-commonmark-before-2.6.0-denial-of-service-via-quadratic-complexity · [email protected]
EPSS history
Timeline
  • 11 SEP 03:14Z
    EPSS moved — → 0%
    epss
  • 09 SEP 13:31Z
    league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
    cvelistv5