CVE-2022-41220

Описание CVE-2022-41220 md2roff 1.9 подвержен переполнению буфера на основе стека, которое возникает при обработке Markdown-файла, содержащего большое количество подряд идущих символов. Воспроизведение Чтобы воспроизвести уязвимость, скачайте уязвимую версию md2roff версия 1.9: git clone...

CVE-2024-58382

A flaw was found in league/commonmark. A remote attacker could exploit polynomial time complexity vulnerabilities in the Markdown parsing component by submitting carefully crafted Markdown inputs. This could lead to a Denial of Service DoS by exhausting CPU resources and PHP-FPM processes when...

Linux Distros Unpatched Vulnerability : CVE-2024-58382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service...

CVE-2026-49865

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

DEBIAN-CVE-2024-58382

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382

CVE-2024-58382 affects the league/commonmark PHP library in versions before 2.6.0 . The root cause is polynomial (quadratic) time complexity in the Markdown parsing engine, allowing attackers to submit carefully crafted Markdown inputs that trigger worst-case performance. Sending multiple such re...

CVE-2024-58382 league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382 league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

EUVD-2024-55755

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382 league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382: Inefficient Algorithmic Complexity

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

PT-2026-88990

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED0 prefixes. Inline shortcode attributes use another unanchored greedy ke...

Regular Expression Denial of Service (ReDoS)

Overview @tiptap/core is a headless rich text editor Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Pandoc-style parseAttributes helper in packages/core/src/utilities/markdown/attributeUtils.ts and the shortcode attribute parser in...

GHSA-J95F-988M-3J2F Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED0 prefixes. Inline shortcode attributes use another unanchored greedy ke...

Denial of Service (DoS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Denial of Service DoS via the note field in the POST /account/accept/acceptance endpoint. An attacker can exhaust server resources by submitting excessively large input,...

EUVD-2026-72870

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...

DEBIAN-CVE-2026-86430

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...