Skip to content
Beaugunderson Ip-address vulnerabilities
-
beaugunderson ip-address
Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
CVE-2026-111997
Fix available
6.3 Medium
-
beaugunderson ip-address
ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
CVE-2026-101913
Fix available
6.3 Medium
-
beaugunderson ip-address
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
CVE-2026-101912
Fix available
6.3 Medium
-
beaugunderson ip-address
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
CVE-2026-101911
Fix available
6.3 Medium
-
beaugunderson ip-address
ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
CVE-2026-101910
Fix available
6.9 Medium
-
beaugunderson ip-address
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
CVE-2026-69198
Fix available
6.9 Medium
-
beaugunderson ip-address
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
CVE-2026-69192
Fix available
7.7 High
-
beaugunderson ip-address
ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
CVE-2026-54272
Fix available
6.9 Medium
-
beaugunderson ip-address, red hat confidential compute attestation, cryostat 4 +38 more +40 more
ip-address: XSS in Address6 HTML-emitting methods
CVE-2026-42338
Fix available
5.3 Medium