The vulnerability allows an attacker to trigger a denial of service by supplying an input string containing many percentage characters. These characters reach the Address6 constructor and cause a quadratic‑time algorithm to run, consuming CPU and causing the application to stall. The flaw results in an irreversible denial of service without any special privileges, consistent with the CWE‑1333 weakness.

Theffected product is the ip-address library developed by beaugunderson. Versions before 10.7.4 are vulnerable. No other vendors or products are listed as affected.

With a CVSS score of 6.3 the vulnerability is considered moderate. EPSS is currently unavailable and the CVE is not in the CISA KEV catalog. Attackers can trigger the denial of service by sending crafted input, potentially from a remote interface that parses IP addresses, though the exact network vector is not explicitly stated. The impact is limited to service availability and may be mitigated by moderate countermeasures.