CVE-2026-101912

A flaw of moderate severity was found in the ip-address JavaScript library, which is bundled as a dependency in the grafana components shipped in Red Hat Hardened Images (Hummingbird). The library's isInSubnet() and isHostInSubnet() methods compare masked binary representations of addresses without first verifying that both operands belong to the same IP address family. Because IPv4 and IPv6 addresses do not share an address space but are padded to their family width before comparison, a cross-family check whose leading bits match evaluates as equal; an IPv4 address can be reported as contained in an IPv6 subnet and vice versa. A remote attacker who can supply an address that an application evaluates with these methods can provide an address from the other address family with matching leading bits so that an unauthorized address outside the intended range is treated as contained, bypassing IP-based allowlist or denylist security restrictions. The impact is limited to the integrity of the access-control decision, with no direct impact on confidentiality or availability; Red Hat rates this flaw as Moderate, consistent with the upstream severity rating. The affected Red Hat Hardened Images grafana components carry a delegated resolution under which the responsible business unit determined that the vulnerable code is not present in the shipped products, so these products are assessed as not affected.