{"id":"MGASA-2026-0377","summary":"Updated python-linkify-it-py package fixes security vulnerabilities","details":"LinkifyIt.match() was quadratic on untrusted input when linkify is\nenabled (GHSA-8m2q-wq3r-6hq8).\nFix quadratic complexity in LinkifyIt.match(), port of linkify-it 5.0.1\nand 5.0.2 (upstream CVE-2026-48801, CVE-2026-59887) (#82)\nMatch validators at a position instead of slicing the tail, needed\nbecause Python 3.10 does not optimize the ^ anchor (#82)\nAllow ; in the email name, matching linkify-it. Behavior change:\na;b@example.com is now linkified (#82)\n","modified":"2026-09-05T04:45:04.114066288Z","published":"2026-09-05T04:35:57Z","upstream":["CVE-2026-48801","CVE-2026-59887"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0377.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=36247"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZROSWVUL5NSOK5V2O56ZMD6SRN2KV7V/"}],"affected":[{"package":{"name":"python-linkify-it-py","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/python-linkify-it-py?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0377.json"}}],"schema_version":"1.9.0","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}