CVE-2026-59887

Aliases:GHSA-v245-v573-v5vmCGA-24mg-m7m2-9379CGA-25gq-p3xg-3854CGA-2jr3-cm9r-qjfmCGA-32gr-x7rw-h6mwCGA-3fjr-6596-rqcmCGA-3vwx-4c7j-358hCGA-3x6w-w92m-35c3CGA-425f-xr36-5vhfCGA-4qj5-w6xr-pvgcCGA-56jv-7f99-2qmmCGA-5whv-8f5v-94q5CGA-649r-v43v-9g52CGA-64hq-gwgg-9jfhCGA-6wjv-cxq9-v5fhCGA-79g5-7r74-fcr8CGA-7m2h-88q5-r49fCGA-7vv4-v7pp-p6x7CGA-8xcm-chgm-7fqqCGA-9j8h-vwvr-77jmCGA-9mvj-wvv6-8485CGA-9pgh-3hqx-2grrCGA-9x92-f8m4-m49wCGA-cp45-242h-3vqmCGA-fjhm-9g4c-rx4pCGA-gm6j-xwqg-g9vgCGA-gvfm-xv9p-39c8CGA-h265-xq5g-82qqCGA-h3q3-p9r8-6fg6CGA-hcv5-hqq8-cmjpCGA-hfp4-ph6f-7j49CGA-hpc7-4w3w-jc88CGA-hqq5-9wqj-6r5mCGA-hx9f-rr55-vx9jCGA-m9x5-vj44-385qCGA-mfp5-w3h5-cp2gCGA-p57j-c239-225gCGA-p6jr-2432-873qCGA-p9g3-pc9x-h953CGA-pf26-hqv8-rm9fCGA-pfr2-jhvr-h55wCGA-pfrp-9xx7-37hrCGA-q4qf-rw8r-fpr3CGA-q5f8-m262-5q4pCGA-qjv3-fr3w-hcvqCGA-qrp3-3r64-c7w3CGA-w232-xjhq-ghq2CGA-w25g-2747-q7wrCGA-wjrm-rx6g-7x73CGA-wxf6-47jx-8xxqCGA-x389-q8cw-8926CGA-xhw7-8g3v-g9jfCGA-xqmv-7f93-g8wcCGA-gg9q-cx9j-5jgrCGA-j3r7-72fg-w57q
Advisory lineage Upstream: 0 Downstream: 1
Downstream
MGASA-2026-0377
Analyzed
Published: 08 Jul 2026, 15:58
Last modified:09 Jul 2026, 14:41

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.43% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

08 Jul 2026, 15:58
Published
Vulnerability first disclosed
09 Jul 2026, 14:41
Last Modified
Vulnerability information updated

Description

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.43%• Percentile: 37%

Techniques & Countermeasures

  • CWE-407•Inefficient Algorithmic Complexity

    An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Affected Systems

  • chainguard•argo-workflows-ui-4.0

    < 4.0.11-r0

  • chainguard•gitlab-rails-ce-18.1

    < 18.1.6-r24

  • chainguard•gitlab-rails-ce-18.10

    all

  • chainguard•gitlab-rails-ce-18.6

    all

  • chainguard•gitlab-rails-ce-18.7

    all

  • chainguard•gitlab-rails-ce-18.8

    all

  • chainguard•gitlab-rails-ce-18.9

    all

  • chainguard•gitlab-rails-ce-19.0

    all

  • chainguard•gitlab-rails-ce-19.1

    all | < 19.1.7-r6

  • chainguard•gitlab-rails-ce-19.2

    all | < 19.2.5-r2

  • chainguard•gitlab-rails-ce-19.3

    < 19.3.1-r6

  • chainguard•gitlab-rails-ce-fips-18.1

    < 18.1.6-r81

  • chainguard•gitlab-rails-ce-fips-18.10

    all

  • chainguard•gitlab-rails-ce-fips-18.6

    all

  • chainguard•gitlab-rails-ce-fips-18.7

    all

  • chainguard•gitlab-rails-ce-fips-18.8

    all

  • chainguard•gitlab-rails-ce-fips-18.9

    all

  • chainguard•gitlab-rails-ce-fips-19.0

    all

  • chainguard•gitlab-rails-ce-fips-19.1

    < 19.1.3-r0

  • chainguard•gitlab-rails-ce-fips-19.2

    < 19.2.1-r2

  • chainguard•kibana-8.19

    < 8.19.18-r3

  • chainguard•kibana-8.19-bitnami

    < 8.19.18-r3

  • chainguard•kibana-8.19-iamguarded

    < 8.19.18-r3

  • chainguard•kibana-9.0

    < 9.0.8-r34

  • chainguard•kibana-9.0-bitnami

    < 9.0.8-r34

  • chainguard•kibana-9.0-iamguarded

    < 9.0.8-r34

  • chainguard•vitess-22

    all

  • wolfi•argo-workflows-ui-4.0

    < 4.0.11-r0

  • markdown-it•linkify-it

    < 5.0.2

  • Npm•linkify-it

    < 5.0.2

References (6)