CVE-2026-59887High· 7.5▾ TwilightA flaw was found in linkify-it, a library for recognizing links. A remote attacker could exploit this vulnerability by providing specially crafted user text. The mailto: schema validator, when processing this input, can be repeatedly invok…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
0.3% → 0.6%
Last analysed / modified upstream
A flaw was found in linkify-it, a library for recognizing links. A remote attacker could exploit this vulnerability by providing specially crafted user text. The mailto: schema validator, when processing this input, can be repeatedly invoked, leading to excessive CPU consumption. This can result in a Denial of Service (DoS) for the affected system.
linkify-it: linkify-it: Denial of Service via crafted mailto: links — rated Important by Red Hat. Released 2026-07-08, updated 2026-09-21.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:68754
Workarounds / mitigations:
Affected packages:
linkify-it <= 5.0.1Patched in:
linkify-it 5.0.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-13149High· 7.5brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
CVE-2026-53550Medium· 5.3js-yaml: js-yaml: Denial of Service via crafted YAML merge keys (CVE-2026-53550)
CVE-2026-73643High· 7.5js-yaml is a JavaScript YAML parser and dumper
CVE-2026-73566High· 7.5node-tar is a tar archive manipulation library for Node.js
CVE-2026-56819High· 7.5io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak (CVE-2026-56819)
CVE-2026-59899High· 7.5io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) (CVE-2026-59899)