CVE-2026-59887High· 7.5▾ TwilightA flaw was found in linkify-it, a library for recognizing links. A remote attacker could exploit this vulnerability by providing specially crafted user text. The mailto: schema validator, when processing this input, can be repeatedly invok…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
0.3% → 0.6%
Last analysed / modified upstream
A flaw was found in linkify-it, a library for recognizing links. A remote attacker could exploit this vulnerability by providing specially crafted user text. The mailto: schema validator, when processing this input, can be repeatedly invoked, leading to excessive CPU consumption. This can result in a Denial of Service (DoS) for the affected system.
linkify-it: linkify-it: Denial of Service via crafted mailto: links — rated Important by Red Hat. Released 2026-07-08, updated 2026-10-22.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:74609 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.10/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv https://access.redhat.com/errata/RHSA-2026:83663
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization/2.11/html-single/migrating_your_virtual_machines_to_red_hat_openshift_virtualization/index#assembly_upgrading-uninstalling-mtv_mtv https://access.redhat.com/errata/RHSA-2026:83662
Workarounds / mitigations:
Affected packages:
linkify-it <= 5.0.1Patched in:
linkify-it 5.0.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-53550Medium· 5.3js-yaml: js-yaml: Denial of Service via crafted YAML merge keys (CVE-2026-53550)
CVE-2026-13149High· 7.5brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
CVE-2026-56864High· 8.1golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB (CVE-2026-56864)
CVE-2026-56865High· 8.8golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass (CVE-2026-5…
CVE-2026-48801High· 7.5linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability (CVE-2026-48801)
CVE-2026-33228Critical· 9.8flatted is a circular JSON parser