Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2024-58382league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

High 7.5

In plain English

A high-severity security flaw in commonmark from thephpleague. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	php-league-commonmark	no fix listed	DEBIAN-CVE-2024-58382
Debian:13	php-league-commonmark	2.6.0-1	DEBIAN-CVE-2024-58382
Debian:14	php-league-commonmark	2.6.0-1	DEBIAN-CVE-2024-58382
Packagist	league/commonmark	2.6.0	GHSA-c2pc-g5qf-rfrf

Affected products (as reported)

Vendor	Product	Versions
thephpleague	commonmark	0 – before 2.6.0

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-c2pc-g5qf-rfrf) vendor-advisory
VulnCheck Advisory: league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity third-party-advisory