Is CVE-2024-58382 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-58382 being exploited in the wild.

How severe is CVE-2024-58382?

High severity, with a CVSS score of 7.5, published 9 September 2026.

Which products and versions are affected?

league/commonmark (Packagist) ECOSYSTEM:introduced=0,fixed=2.6.0; The PHP League CommonMark before 2.6.0.

Is there a fix for CVE-2024-58382?

Yes. league/commonmark (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-58382 attacked?

It is attacked over the network.

Am I affected by CVE-2024-58382?

Check whether you run league/commonmark (Packagist) or The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58382: league/commonmark polynomial time complexity denial of service

CVE-2024-58382 · Severity: high · CVSS 7.5 · Published 2026-09-09

league/commonmark is a PHP library that parses Markdown text, widely used in web applications. Versions before 2.6.0 contain algorithmic inefficiencies that allow attackers to submit malicious Markdown inputs that consume excessive CPU resources. An attacker can exhaust server processing capacity and crash PHP services by sending multiple crafted requests in parallel, making the application unavailable to legitimate users.

Technologies: league/commonmark (Packagist), The PHP League CommonMark. Vendors: Packagist, The PHP League.

Quick answers

Is CVE-2024-58382 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-58382 being exploited in the wild.
How severe is CVE-2024-58382?: High severity, with a CVSS score of 7.5, published 9 September 2026.
Which products and versions are affected?: league/commonmark (Packagist) ECOSYSTEM:introduced=0,fixed=2.6.0; The PHP League CommonMark before 2.6.0.
Is there a fix for CVE-2024-58382?: Yes. league/commonmark (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58382 attacked?: It is attacked over the network.
Am I affected by CVE-2024-58382?: Check whether you run league/commonmark (Packagist) or The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

league/commonmark (Packagist): upgrade to 2.6.0 or later
```
composer require league/commonmark:^2.6.0
```

Technical details

This vulnerability is a polynomial time complexity issue (CWE-407) in the Markdown parsing algorithm used by league/commonmark. The root cause stems from inefficient pattern matching and parsing logic that reaches worst-case O(n²) or higher complexity when processing specially crafted Markdown inputs. The attack vector is network-based with no authentication or user interaction required—an attacker simply submits malicious Markdown strings via any application feature that uses this library. By sending multiple requests in parallel, an attacker can exhaust CPU resources and PHP-FPM worker processes, resulting in denial of service. The vulnerability has been patched in version 2.6.0; users on older versions should upgrade immediately or implement rate-limiting and input size restrictions as mitigations.

Affected products

The PHP League commonmark before 2.6.0

Identifiers

CVE-2024-58382
GHSA-c2pc-g5qf-rfrf

Timeline

2024-12-07: disclosed
2024-12-07: patched: Version 2.6.0 released with patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.