{
  "threat_severity" : "Moderate",
  "public_date" : "2026-07-14T20:03:56Z",
  "bugzilla" : {
    "description" : "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability",
    "id" : "2500656",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2500656"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-1333",
  "details" : [ "linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.", "A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package's primary public API, has an algorithmic complexity of O(N²) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled." ],
  "statement" : "This Moderate impact flaw in linkify-it, a link recognition library, can lead to a denial of service in Red Hat products. The vulnerability arises from an O(N²) algorithmic complexity when processing untrusted Markdown with numerous fuzzy links or emails, potentially causing excessive CPU consumption and worker-process unavailability. This risk is present in services that synchronously render untrusted Markdown with the linkify feature enabled.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57590",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "rh-podman-desktop-0:1.1.2-1.el10_2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2.1",
    "release_date" : "2026-08-05T00:00:00Z",
    "advisory" : "RHSA-2026:50850",
    "cpe" : "cpe:/a:redhat:ansible_portal:2.1",
    "package" : "ansible-automation-platform/automation-portal:1785854226"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2.2",
    "release_date" : "2026-07-21T00:00:00Z",
    "advisory" : "RHSA-2026:42815",
    "cpe" : "cpe:/a:redhat:ansible_portal:2.2",
    "package" : "ansible-automation-platform/automation-portal:1784622951"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2.2",
    "release_date" : "2026-08-06T00:00:00Z",
    "advisory" : "RHSA-2026:51162",
    "cpe" : "cpe:/a:redhat:ansible_portal:2.2::el9",
    "package" : "ansible-automation-platform/bootc-automation-portal-rhel9:1786006573"
  }, {
    "product_name" : "Red Hat Developer Hub 1.10",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:48126",
    "cpe" : "cpe:/a:redhat:rhdh:1.10::el9",
    "package" : "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend:1785332825"
  }, {
    "product_name" : "Red Hat Developer Hub 1.10",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:48126",
    "cpe" : "cpe:/a:redhat:rhdh:1.10::el9",
    "package" : "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki:1785332668"
  }, {
    "product_name" : "Red Hat Developer Hub 1.10",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:48126",
    "cpe" : "cpe:/a:redhat:rhdh:1.10::el9",
    "package" : "rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator:1785332694"
  }, {
    "product_name" : "Red Hat Developer Hub 1.10",
    "release_date" : "2026-08-03T00:00:00Z",
    "advisory" : "RHSA-2026:49642",
    "cpe" : "cpe:/a:redhat:rhdh:1.10::el9",
    "package" : "rhdh/rhdh-hub-rhel9:1785411652"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-11T00:00:00Z",
    "advisory" : "RHSA-2026:38187",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "rust-main-1.97.0-1.1.hum1",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat OpenShift AI 3.4",
    "release_date" : "2026-08-27T00:00:00Z",
    "advisory" : "RHSA-2026:60520",
    "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9",
    "package" : "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9:1787121387"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.2",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:60446",
    "cpe" : "cpe:/a:redhat:openshift:4.20::el9",
    "package" : "openshift4/ose-console-rhel9:1787737695"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.2",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:60446",
    "cpe" : "cpe:/a:redhat:openshift:4.20::el9",
    "package" : "openshift4/ose-monitoring-plugin-rhel9:1787736396"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.21",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:60477",
    "cpe" : "cpe:/a:redhat:openshift:4.21::el9",
    "package" : "openshift4/ose-console-rhel9:1787590523"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.21",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:60477",
    "cpe" : "cpe:/a:redhat:openshift:4.21::el9",
    "package" : "openshift4/ose-monitoring-plugin-rhel9:1787590390"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.22",
    "release_date" : "2026-08-11T00:00:00Z",
    "advisory" : "RHSA-2026:51038",
    "cpe" : "cpe:/a:redhat:openshift:4.22::el9",
    "package" : "openshift4/ose-console-rhel9:1785910938"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.22",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:60441",
    "cpe" : "cpe:/a:redhat:openshift:4.22::el9",
    "package" : "openshift4/ose-monitoring-plugin-rhel9:1787730804"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.22",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:60441",
    "cpe" : "cpe:/a:redhat:openshift:4.22::el9",
    "package" : "openshift4/ose-networking-console-plugin-rhel9:1787745534"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/cephcsi-rhel9:1786705347"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/cephcsi-rhel9-operator:1786706101"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/mcg-core-rhel9:1786705558"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/mcg-rhel9-operator:1786705646"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/ocs-client-console-rhel9:1786706138"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/ocs-client-rhel9-operator:1786705741"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/ocs-metrics-exporter-rhel9:1786705777"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/ocs-rhel9-operator:1786705802"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/odf-cli-rhel9:1786705938"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/odf-console-rhel9:1786706577"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/odf-cosi-sidecar-rhel9:1786706125"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/odf-csi-addons-rhel9-operator:1786706177"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/odf-csi-addons-sidecar-rhel9:1786706188"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/odf-multicluster-console-rhel9:1786706679"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/odf-multicluster-rhel9-operator:1786706357"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/odf-must-gather-rhel9:1786706612"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/odf-rhel9-operator:1786706644"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/odr-rhel9-operator:1786706659"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.18",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56431",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.18::el9",
    "package" : "odf4/rook-ceph-rhel9-operator:1786706880"
  } ],
  "package_state" : [ {
    "product_name" : "Migration Toolkit for Virtualization",
    "fix_state" : "Affected",
    "package_name" : "migration-toolkit-virtualization/mtv-console-plugin-rhel9",
    "cpe" : "cpe:/a:redhat:migration_toolkit_virtualization:2"
  }, {
    "product_name" : "Migration Toolkit for Virtualization",
    "fix_state" : "Will not fix",
    "package_name" : "mtv-candidate/mtv-console-plugin-rhel9",
    "cpe" : "cpe:/a:redhat:migration_toolkit_virtualization:2"
  }, {
    "product_name" : "Node HealthCheck Operator",
    "fix_state" : "Affected",
    "package_name" : "workload-availability/node-healthcheck-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:workload_availability_nhc:0"
  }, {
    "product_name" : "Node HealthCheck Operator",
    "fix_state" : "Affected",
    "package_name" : "workload-availability/node-healthcheck-operator-bundle",
    "cpe" : "cpe:/a:redhat:workload_availability_nhc:0"
  }, {
    "product_name" : "Node HealthCheck Operator",
    "fix_state" : "Affected",
    "package_name" : "workload-availability/node-healthcheck-rhel9-operator",
    "cpe" : "cpe:/a:redhat:workload_availability_nhc:0"
  }, {
    "product_name" : "Node HealthCheck Operator",
    "fix_state" : "Affected",
    "package_name" : "workload-availability/node-remediation-console-rhel8",
    "cpe" : "cpe:/a:redhat:workload_availability_nhc:0"
  }, {
    "product_name" : "Node HealthCheck Operator",
    "fix_state" : "Affected",
    "package_name" : "workload-availability/node-remediation-console-rhel9",
    "cpe" : "cpe:/a:redhat:workload_availability_nhc:0"
  }, {
    "product_name" : "OpenShift Pipelines",
    "fix_state" : "Affected",
    "package_name" : "openshift-pipelines/pipelines-console-plugin-pf5-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_pipelines:1"
  }, {
    "product_name" : "OpenShift Pipelines",
    "fix_state" : "Affected",
    "package_name" : "openshift-pipelines/pipelines-console-plugin-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_pipelines:1"
  }, {
    "product_name" : "OpenShift Pipelines",
    "fix_state" : "Affected",
    "package_name" : "openshift-pipelines/pipelines-console-plugin-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_pipelines:1"
  }, {
    "product_name" : "Red Hat Build of Podman Desktop",
    "fix_state" : "Affected",
    "package_name" : "rh-podman-desktop.git",
    "cpe" : "cpe:/a:redhat:podman_desktop:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "libgit2",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-console",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-monitoring-plugin-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Dev Spaces",
    "fix_state" : "Affected",
    "package_name" : "devspaces/code-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3"
  }, {
    "product_name" : "Red Hat OpenShift Dev Spaces",
    "fix_state" : "Affected",
    "package_name" : "devspaces/openvsx-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3"
  }, {
    "product_name" : "Red Hat OpenShift Dev Spaces",
    "fix_state" : "Affected",
    "package_name" : "devspaces/pluginregistry-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 4",
    "fix_state" : "Not affected",
    "package_name" : "container-native-virtualization/kubevirt-console-plugin-rhel9",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-48801\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48801\nhttps://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159\nhttps://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4" ],
  "name" : "CVE-2026-48801",
  "csaw" : false
}