Polynomial Time Complexity Denial of Service in league/commonmark

The PHP library league/commonmark, specifically versions prior to 2.6.0, is susceptible to a denial-of-service (DoS) vulnerability (CVE-2024-58382). The issue stems from polynomial time complexity within the library's Markdown parsing logic. An unauthenticated attacker can submit specifically crafted, malicious Markdown strings that force the parser into a worst-case performance scenario. When these requests are submitted concurrently or at a high frequency, the resulting computational load consumes excessive CPU resources and exhausts available PHP-FPM worker processes, effectively rendering the host application unresponsive to legitimate user traffic. This vulnerability represents a significant risk for any application that accepts user-provided Markdown content without robust input sanitization or resource rate limiting. Defenders should prioritize patching to version 2.6.0 or later.

Impact

Successful exploitation results in service unavailability. By exhausting CPU resources and PHP-FPM processes, an attacker can crash the application or prevent it from processing legitimate requests. This poses a high availability risk to any web platform utilizing commonmark for user-generated content, such as forums, comment sections, or document editors.

Recommendation

• Upgrade league/commonmark to version 2.6.0 or later immediately to address the underlying parser flaw associated with CVE-2024-58382.
• Implement request rate limiting for endpoints that accept and process user-supplied Markdown to mitigate the risk of concurrent resource exhaustion.
• Monitor PHP-FPM process pools for unexpected saturation or persistent high CPU utilization, which may indicate active exploitation attempts.