Bibu123456

**Name of the Vulnerable Software and Affected Versions** linkify-it versions prior to 5.0.2 Confluence Data Center versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.1.2, and 10.2.0 **Description** A Regular Expression Denial of Service (ReDoS) exists in the `mailto:` schema validator. When using the `.test()` or `.match()` functions, the validator is triggered at every occurrence of `mailto:`. The `src email name` variable in `lib/re.mjs` greedily scans the remaining input text, leading to quadratic O(n^2) CPU consumption. An unauthenticated attacker can exploit this by providing crafted user text, such as repeated `mailto:` strings, which can block the single-threaded event loop for several seconds and make the service unavailable. **Recommendations** Update linkify-it to version 5.0.2. For Confluence Data Center 9.2, upgrade to a release greater than or equal to 9.2.23. For Confluence Data Center 10.2, upgrade to a release greater than or equal to 10.2.15.

**Name of the Vulnerable Software and Affected Versions** shell-quote versions prior to 1.8.5 **Description** The `parse()` function finalizes parsed tokens using `Array.prototype.concat` as a reduce accumulator, which causes the entire growing array to be reallocated and copied during every iteration. This results in quadratic time complexity relative to the number of input tokens. An attacker providing a controlled string to any code path that calls `parse()` can block the single-threaded Node.js event loop for an extended period, leading to a denial of service. This issue affects availability and does not allow for code execution or data disclosure. **Recommendations** Update to version 1.8.5.