Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseGHSA-c2pc-g5qf-rfrf
GHSA-c2pc-g5qf-rfrf:
PHP vulnerability analysis and mitigation
Overview
A high severity vulnerability (GHSA-c2pc-g5qf-rfrf) was discovered in league/commonmark affecting versions prior to 2.6.0. The vulnerability involves multiple polynomial time complexity issues that could lead to unbounded resource exhaustion and subsequent denial of service. The issue was published on December 7, 2024, and affects the PHP Composer package league/commonmark (GitHub Advisory).
Technical details
The vulnerability stems from several quadratic complexity bugs in the library's markdown parsing functionality. These issues can be triggered by carefully crafted Markdown inputs specifically designed to achieve worst-case performance scenarios. The vulnerability has a CVSS score of 7.5 (High) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating it can be exploited remotely with low complexity and requires no privileges or user interaction (GitHub Advisory).
Impact
When exploited, these vulnerabilities can lead to denial of service conditions by exhausting system resources. Malicious users can send multiple specially crafted requests in parallel, potentially tying up all available CPU resources and/or PHP-FPM processes, which would prevent legitimate users from accessing the service (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in version 2.6.0, and users are strongly encouraged to upgrade. For those unable to upgrade immediately, several workarounds are available: setting low memorylimit and maxexecution_time PHP configurations, implementing rate-limiting and bot protection, limiting input sizes (particularly the max length of each line), and restricting the library's use to trusted users only (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management