CVE-2024-58382

A flaw was found in league/commonmark. A remote attacker could exploit polynomial time complexity vulnerabilities in the Markdown parsing component by submitting carefully crafted Markdown inputs. This could lead to a Denial of Service DoS by exhausting CPU resources and PHP-FPM processes when...

Linux Distros Unpatched Vulnerability : CVE-2024-58382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service...

CVE-2024-58382

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

DEBIAN-CVE-2024-58382

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2026-86751 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

EUVD-2026-74928

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

CVE-2024-58382

CVE-2024-58382 affects the league/commonmark PHP library in versions before 2.6.0 . The root cause is polynomial (quadratic) time complexity in the Markdown parsing engine, allowing attackers to submit carefully crafted Markdown inputs that trigger worst-case performance. Sending multiple such re...

CVE-2024-58382 league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382 league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

EUVD-2024-55755

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382 league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

PT-2026-88990

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

PT-2026-89020

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

CVE-2026-86734

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...

CVE-2026-86734 Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...

CVE-2026-86734

Snipe-IT versions before 8.7.1 are affected by a denial-of-service vulnerability in the POST /account/accept/{acceptance} endpoint. The root cause is the absence of length validation on the note field , allowing authenticated users to submit arbitrarily large values that trigger synchronous Commo...

EUVD-2026-72870

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...

CVE-2026-86734 Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...

CVE-2026-86435

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessiv...