Advisories » MGASA-2026-0377

Updated python-linkify-it-py package fixes security vulnerabilities

Publication date: 05 Sep 2026
Modification date: 05 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-48801 , CVE-2026-59887

Description

LinkifyIt.match() was quadratic on untrusted input when linkify is
enabled (GHSA-8m2q-wq3r-6hq8).
Fix quadratic complexity in LinkifyIt.match(), port of linkify-it 5.0.1
and 5.0.2 (upstream CVE-2026-48801, CVE-2026-59887) (#82)
Match validators at a position instead of slicing the tail, needed
because Python 3.10 does not optimize the ^ anchor (#82)
Allow ; in the email name, matching linkify-it. Behavior change:
a;b@example.com is now linkified (#82)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36247
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZROSWVUL5NSOK5V2O56ZMD6SRN2KV7V/
• https://www.cve.org/CVERecord?id=CVE-2026-48801
• https://www.cve.org/CVERecord?id=CVE-2026-59887

SRPMS

10/core

• python-linkify-it-py-2.1.1-1.mga10