What is GHSA-fv22-86fq-c33q?

GHSA-fv22-86fq-c33q is a security advisory published by GitHub Security Advisories with High severity. league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in...

Which CVE IDs does GHSA-fv22-86fq-c33q cover?

GHSA-fv22-86fq-c33q covers the following CVE IDs: CVE-2024-58382. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fv22-86fq-c33q?

GHSA-fv22-86fq-c33q has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-fv22-86fq-c33qHighCVSS 7.5

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in...

Vendor

GitHub Security Advisories

Published

September 9, 2026

Last Modified

September 9, 2026

🔗 CVE IDs covered (1)

CVE-2024-58382 →

📋 Description

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.

🔗 References (4)

https://github.com/thephpleague/commonmark/security/advisories/GHSA-c2pc-g5qf-rfrf
https://nvd.nist.gov/vuln/detail/CVE-2024-58382
https://www.vulncheck.com/advisories/league-commonmark-before-2.6.0-denial-of-service-via-quadratic-complexity
https://github.com/advisories/GHSA-fv22-86fq-c33q