Description
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
Published: 2026-10-18
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

The vulnerability allows an attacker to trigger a denial of service by supplying an input string containing many percentage characters. These characters reach the Address6 constructor and cause a quadratic‑time algorithm to run, consuming CPU and causing the application to stall. The flaw results in an irreversible denial of service without any special privileges, consistent with the CWE‑1333 weakness.

Affected Systems

Theffected product is the ip-address library developed by beaugunderson. Versions before 10.7.4 are vulnerable. No other vendors or products are listed as affected.

Risk and Exploitability

With a CVSS score of 6.3 the vulnerability is considered moderate. EPSS is currently unavailable and the CVE is not in the CISA KEV catalog. Attackers can trigger the denial of service by sending crafted input, potentially from a remote interface that parses IP addresses, though the exact network vector is not explicitly stated. The impact is limited to service availability and may be mitigated by moderate countermeasures.

Generated by OpenCVE AI on October 18, 2026 at 01:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the ip-address library to version 10.7.4 or later
  • Validate or limit the length of input strings to prevent excessive % characters
  • Monitor CPU usage for abnormal spikes that may indicate an exploitation attempt

Generated by OpenCVE AI on October 18, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-rxp7-6hxx-x8q5 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
History

Sun, 18 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Beaugunderson
Beaugunderson ip-address
Vendors & Products Beaugunderson
Beaugunderson ip-address

Sun, 18 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 18 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title Denial of Service via Excessive % Characters in Address6 Parsing ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

threat_severity

Moderate

Sun, 18 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Denial of Service via Excessive % Characters in Address6 Parsing

Sun, 18 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
Weaknesses CWE-1333
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Beaugunderson Ip-address
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-18T11:12:55.202Z

Reserved: 2026-10-18T00:07:20.697Z

Link: CVE-2026-111997

cve-icon Vulnrichment

Updated: 2026-10-18T11:12:50.439Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-18T01:16:35.463

Modified: 2026-10-19T21:13:39.973

Link: CVE-2026-111997

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:07:21Z

Links: CVE-2026-111997 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T22:15:14Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity