Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-09-28T17:46:52
ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.
A flaw was found in the ip-address library. A remote attacker can exploit this vulnerability by supplying an excessively large IPv6 address string to an application that parses input without length limits. The parser attempts to process the unbounded input and generate disproportionately large error diagnostics, leading to excessive memory consumption. This issue can lead to a Denial of Service (DoS) by causing the application process to stall or crash.
This vulnerability is assessed as Moderate severity because triggering service disruption requires applications to accept multi-megabyte network inputs into the address parser without front-end length restrictions. In typical Red Hat environments and standard HTTP deployments, web servers, reverse proxies, and request parsers enforce strict request size and header boundaries by default, which significantly limits the blast radius. Consequently, while malformed inputs may induce brief event-loop stalls or transient memory spikes, triggering an unhandled process termination necessitates an exceptionally large payload that is rejected under standard production configurations.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Red Hat Enterprise Linux 8
2026-10-29T00:00:00Z
RHSA-2026:92376
nodejs:24-8100020261027151919.6d880403
Red Hat Enterprise Linux 9
2026-10-29T00:00:00Z
RHSA-2026:92378
nodejs:24-9080020261027142403.rhel9
Cryostat 4
Fix deferred
cryostat/cryostat-openshift-console-plugin-rhel9
Exploit Intelligence
Fix deferred
exploit-intelligence/vulnerability-analysis-rhel9
Migration Toolkit for Applications 8
Fix deferred
mta/mta-cli-rhel9
Migration Toolkit for Applications 8
Fix deferred
mta/mta-generic-external-provider-rhel9
Migration Toolkit for Containers
Fix deferred
rhmtc/openshift-migration-ui-rhel8
Multicluster Engine for Kubernetes
Fix deferred
multicluster-engine/console-mce-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Fix deferred
rhacm2/console-rhel9
Red Hat AMQ Broker 7
Fix deferred
amq-broker-bin.zip
Red Hat AMQ Broker 7
Fix deferred
amq-broker-maven-repository.zip
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-tech-preview/mcp-server-rhel9
Red Hat build of Apache Camel for Spring Boot 4
Fix deferred
rhaf-camel-for-springboot-maven-repository.zip
Red Hat build of Apache Camel for Spring Boot 4
Fix deferred
rhaf-camel-maven-repository.zip
Red Hat build of Apache Camel for Spring Boot 4
Fix deferred
rhaf-camel-spring-boot-maven-repository.zip
Red Hat build of Apache Camel - HawtIO 4
Fix deferred
rhaf-hawtio-maven-repository.zip
Red Hat Build of Podman Desktop
Fix deferred
rh-podman-desktop
Red Hat Connectivity Link 1
Fix deferred
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Developer Hub 1
Fix deferred
rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend
Red Hat Developer Hub 1
Fix deferred
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend
Red Hat Developer Hub 1
Fix deferred
rhdh/rhdh-hub-rhel9
Red Hat Enterprise Linux 10
Fix deferred
grafana
Red Hat Enterprise Linux 10
Fix deferred
grafana-pcp
Red Hat Enterprise Linux 10
Fix deferred
linux-sgx
Red Hat Enterprise Linux 10
Fix deferred
nodejs22
Red Hat Enterprise Linux 10
Fix deferred
nodejs24
Red Hat Enterprise Linux 10
Fix deferred
nodejs26
Red Hat Enterprise Linux 10
Fix deferred
rust
Red Hat Enterprise Linux 10
Fix deferred
ubi10/nodejs-22
Red Hat Enterprise Linux 10
Fix deferred
ubi10/nodejs-22-minimal
Red Hat Enterprise Linux 10
Fix deferred
ubi10/nodejs-24
Red Hat Enterprise Linux 10
Fix deferred
ubi10/nodejs-24-minimal
Red Hat Enterprise Linux 10
Fix deferred
ubi10/s2i-base
Red Hat Enterprise Linux 8
Fix deferred
nodejs:22/nodejs
Red Hat Enterprise Linux 8
Fix deferred
rust-toolset:rhel8/rust
Red Hat Enterprise Linux 8
Fix deferred
ubi8/nodejs-22
Red Hat Enterprise Linux 8
Fix deferred
ubi8/nodejs-22-minimal
Red Hat Enterprise Linux 8
Fix deferred
ubi8/nodejs-24
Red Hat Enterprise Linux 8
Fix deferred
ubi8/nodejs-24-minimal
Red Hat Enterprise Linux 8
Fix deferred
ubi8/s2i-base
Red Hat Enterprise Linux 9
Fix deferred
linux-sgx
Red Hat Enterprise Linux 9
Fix deferred
nodejs:22/nodejs
Red Hat Enterprise Linux 9
Fix deferred
nodejs:26/nodejs
Red Hat Enterprise Linux 9
Fix deferred
rust
Red Hat Enterprise Linux 9
Fix deferred
ubi9/nodejs-22
Red Hat Enterprise Linux 9
Fix deferred
ubi9/nodejs-22-minimal
Red Hat Enterprise Linux 9
Fix deferred
ubi9/nodejs-24
Red Hat Enterprise Linux 9
Fix deferred
ubi9/nodejs-24-minimal
Red Hat Enterprise Linux 9
Fix deferred
ubi9/s2i-base
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/disk-image-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rust
Red Hat Hardened Images
Not affected
grafana12.4
Red Hat Hardened Images
Not affected
grafana13.1
Red Hat Hardened Images
Not affected
grafana13.2
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 5
Fix deferred
openshift5/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 5
Fix deferred
openshift5/ose-console-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/mcg-core-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/dashboard-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/openvsx-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/pluginregistry-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/udi-rhel9
Red Hat Satellite 6
Fix deferred
satellite/iop-remediations-rhel9
Self-service automation portal 2
Fix deferred
ansible-automation-platform/automation-portal
Self-service automation portal 2
Fix deferred
ansible-automation-platform/bootc-automation-portal-rhel9
https://www.cve.org/CVERecord?id=CVE-2026-101911
https://nvd.nist.gov/vuln/detail/CVE-2026-101911
https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134
https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5
https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1
https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw