# CVE-2024-58382: league/commonmark polynomial time complexity denial of service

Source: https://junglewise.ai/threats/cve-2024-58382-league-commonmark-polynomial-time-complexity-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2024-58382 · Severity: high · CVSS 7.5 · Published 2026-09-09

league/commonmark is a PHP library that parses Markdown text, widely used in web applications. Versions before 2.6.0 contain algorithmic inefficiencies that allow attackers to submit malicious Markdown inputs that consume excessive CPU resources. An attacker can exhaust server processing capacity and crash PHP services by sending multiple crafted requests in parallel, making the application unavailable to legitimate users.

Technologies: [league/commonmark (Packagist)](https://junglewise.ai/threats/technologies/league-commonmark), [The PHP League CommonMark](https://junglewise.ai/threats/technologies/commonmark). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [The PHP League](https://junglewise.ai/threats/vendors/the-php-league).

## Quick answers

**Is CVE-2024-58382 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-58382 being exploited in the wild.

**How severe is CVE-2024-58382?** High severity, with a CVSS score of 7.5, published 9 September 2026.

**Which products and versions are affected?** league/commonmark (Packagist) ECOSYSTEM:introduced=0,fixed=2.6.0; The PHP League CommonMark before 2.6.0.

**Is there a fix for CVE-2024-58382?** Yes. league/commonmark (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-58382 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-58382?** Check whether you run league/commonmark (Packagist) or The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- league/commonmark (Packagist): upgrade to 2.6.0 or later

  ```sh
  composer require league/commonmark:^2.6.0
  ```


## Technical details

This vulnerability is a polynomial time complexity issue (CWE-407) in the Markdown parsing algorithm used by league/commonmark. The root cause stems from inefficient pattern matching and parsing logic that reaches worst-case O(n²) or higher complexity when processing specially crafted Markdown inputs. The attack vector is network-based with no authentication or user interaction required—an attacker simply submits malicious Markdown strings via any application feature that uses this library. By sending multiple requests in parallel, an attacker can exhaust CPU resources and PHP-FPM worker processes, resulting in denial of service. The vulnerability has been patched in version 2.6.0; users on older versions should upgrade immediately or implement rate-limiting and input size restrictions as mitigations.

## Affected products

- The PHP League commonmark before 2.6.0

## Identifiers

- CVE-2024-58382
- GHSA-c2pc-g5qf-rfrf

## Timeline

- 2024-12-07: disclosed
- 2024-12-07: patched: Version 2.6.0 released with patch

## References

- [https://github.com/thephpleague/commonmark/security/advisories/GHSA-c2pc-g5qf-rfrf](https://github.com/thephpleague/commonmark/security/advisories/GHSA-c2pc-g5qf-rfrf)
- [https://www.vulncheck.com/advisories/league-commonmark-before-2.6.0-denial-of-service-via-quadratic-complexity](https://www.vulncheck.com/advisories/league-commonmark-before-2.6.0-denial-of-service-via-quadratic-complexity)

## Related threats

- [league/commonmark DisallowedRawHtml XSS bypass in tag parsing](https://junglewise.ai/threats/league-commonmark-disallowedrawhtml-bypassed-when-a-disallowed-tag-name-cea607bc)
- [league/commonmark quadratic DoS in GitHub Flavored Markdown table parser](https://junglewise.ai/threats/league-commonmark-quadratic-time-denial-of-service-in-the-github-a4135205)
- [commonmark Footnote extension denial of service](https://junglewise.ai/threats/cve-2026-86435-commonmark-footnote-extension-denial-of-service)
- [commonmark XmlRenderer denial of service via nested XML indentation](https://junglewise.ai/threats/cve-2026-86432-commonmark-xmlrenderer-denial-of-service-via-nested-xml)
- [league/commonmark AttributesExtension XSS bypass with U+000C](https://junglewise.ai/threats/cve-2026-86431-league-commonmark-attributesextension-xss-bypass-with-u-000c)