CVE-2024-58382: league/commonmark DoS Vulnerability

CVE-2024-58382 Overview

CVE-2024-58382 affects the league/commonmark PHP library, a widely used Markdown parser maintained by The PHP League. Versions prior to 2.6.0 contain polynomial time complexity flaws in the Markdown parsing logic. Attackers can submit crafted Markdown input designed to trigger worst-case parser performance. Sending multiple such requests in parallel exhausts CPU resources and saturates PHP-FPM worker processes, resulting in denial of service. The flaw is tracked under CWE-407: Inefficient Algorithmic Complexity and requires no authentication or user interaction to exploit.

Critical Impact
Remote unauthenticated attackers can exhaust CPU and PHP-FPM workers on any web application that accepts and renders user-supplied Markdown through league/commonmark.

Affected Products

league/commonmark PHP library versions prior to 2.6.0
PHP web applications that expose Markdown rendering endpoints using vulnerable versions
Downstream frameworks and CMS platforms that bundle league/commonmark as a dependency

Discovery Timeline

2026-09-09 - CVE-2024-58382 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2024-58382

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw in the Markdown parsing routines of league/commonmark. Specific parser paths exhibit polynomial (quadratic) growth in processing time relative to input size. An attacker who understands the worst-case grammar patterns can craft small Markdown payloads that force the parser into these expensive code paths.

Because league/commonmark typically runs synchronously inside PHP-FPM worker processes, a single slow request occupies a worker for its entire duration. Parallelized requests exhaust the FPM pool, blocking legitimate users. The impact is limited to availability; confidentiality and integrity are not affected.

Root Cause

The root cause is inefficient algorithmic complexity (CWE-407) in specific inline and block parsing routines. Certain nested or repetitive Markdown constructs cause the parser to perform redundant scans of the same input regions, driving processing time to polynomial complexity rather than linear. Fixes shipped in 2.6.0 refactor the affected parsing paths to bounded, near-linear behavior.

Attack Vector

Exploitation requires only network access to an endpoint that passes attacker-controlled data to the vulnerable Markdown parser. Common attack surfaces include comment forms, chat and messaging features, wiki and note-taking applications, issue trackers, and REST APIs that accept Markdown for rendering. The attacker submits pathological Markdown payloads in parallel, saturating CPU cores and PHP-FPM workers until the application becomes unresponsive. See the GitHub Security Advisory GHSA-c2pc-g5qf-rfrf and the VulnCheck advisory for further technical background.

// No verified proof-of-concept code is published for this CVE.
// The vulnerability manifests when crafted Markdown input triggers
// polynomial-time parsing paths inside league/commonmark < 2.6.0.

Detection Methods for CVE-2024-58382

Indicators of Compromise

Sudden spikes in PHP-FPM CPU utilization correlated with POST or PUT requests carrying Markdown payloads.
PHP-FPM slowlog entries showing extended execution time inside League\CommonMark parser methods.
Bursts of concurrent HTTP requests to Markdown-rendering endpoints from a small set of source IP addresses.
Elevated HTTP 502 or 504 responses from upstream web servers as PHP-FPM workers become saturated.

Detection Strategies

Inventory PHP applications with composer show league/commonmark and flag any version below 2.6.0.
Instrument application performance monitoring (APM) to track per-request parsing latency for Markdown endpoints.
Enable PHP-FPM request_slowlog_timeout and review stack traces referencing CommonMark parser frames.
Correlate web access logs with worker pool exhaustion events to identify pathological input patterns.

Monitoring Recommendations

Alert on PHP-FPM pool saturation, request queue depth, and sustained high CPU on web tiers.
Log request body sizes and rendering durations on Markdown endpoints for anomaly analysis.
Track repeated large or repetitive Markdown submissions from single clients through the web application firewall (WAF).
Ingest web and application telemetry into a centralized data lake for cross-source correlation and long-term hunting.

How to Mitigate CVE-2024-58382

Immediate Actions Required

Upgrade league/commonmark to version 2.6.0 or later in all affected applications.
Audit dependency trees for indirect inclusion of vulnerable versions via frameworks or bundled packages.
Apply request size and rate limits on endpoints that accept Markdown input.
Increase PHP-FPM monitoring sensitivity to detect worker exhaustion earlier.

Patch Information

The maintainers resolved the polynomial complexity paths in league/commonmark2.6.0. Consult the GitHub Security Advisory GHSA-c2pc-g5qf-rfrf for the authoritative fix reference and the VulnCheck advisory for additional context. Update via Composer and redeploy affected services.

Workarounds

Enforce a strict maximum length on user-supplied Markdown at the application boundary before parsing.
Deploy WAF rules to drop or throttle requests containing highly repetitive Markdown constructs.
Offload Markdown rendering to a queue or isolated worker pool so parser stalls do not affect front-end request handling.
Add per-client rate limiting on endpoints that invoke the parser to reduce parallel exhaustion risk.

bash

# Upgrade league/commonmark to a fixed version via Composer
composer require league/commonmark:^2.6.0

# Verify the installed version
composer show league/commonmark | grep versions

# Enable PHP-FPM slow request logging to detect parser stalls
# In your PHP-FPM pool configuration (e.g., www.conf):
#   slowlog = /var/log/php-fpm/www-slow.log
#   request_slowlog_timeout = 2s