CVE-2024-58382: league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
league/commonmarkto a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using league/commonmark versions before 2.6.0 are exposed if they parse Markdown that an attacker can submit. The issue is especially relevant where multiple parsing requests can be made in parallel against PHP-FPM-backed deployments.
What does an attacker need to exploit it?
No privileges or user interaction are required. An attacker needs the ability to submit carefully crafted Markdown input that triggers worst-case parsing performance, and can increase impact by sending multiple such requests concurrently.
What is the operational impact of exploitation?
Processing the crafted Markdown can consume excessive CPU time. Parallel requests can exhaust CPU resources and available PHP-FPM processes, causing a denial of service.
How can I determine whether my application is affected?
Check whether the application depends on league/commonmark and identify the installed version. Versions before 2.6.0 are affected.