Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in ip-address(CVE-2026-101910,CVE-2026-101913)

Summary IBM Db2 Developer Extension is affected by vulnerability in ip-addressCVE-2026-101910,CVE-2026-101913 Vulnerability Details CVEID:CVE-2026-101910 DESCRIPTION: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in ip-address(CVE-2026-101910, CVE-2026-101911, CVE-2026-101912, CVE-2026-101913)

Summary IBM Db2 Developer Extension is affected by vulnerability in ip-addressCVE-2026-101910, CVE-2026-101911, CVE-2026-101912, CVE-2026-101913 Vulnerability Details CVEID:CVE-2026-101910 DESCRIPTION: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Fro...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in ip-address(CVE-2026-111997)

Summary IBM Db2 Developer Extension is affected by vulnerability in ip-addressCVE-2026-111997 Vulnerability Details CVEID:CVE-2026-111997 DESCRIPTION: ip-address before 10.7.4 allows a denial of service CPU consumption from quadratic complexity, and application stall via many % characters in inpu...

npm: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

npm: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process vulnerability discovered by ? in WordPress npm ip-address versions = 10.7.3...

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Summary new Address6 and Address6.isValid strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before...

GHSA-RXP7-6HXX-X8Q5 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Summary new Address6 and Address6.isValid strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before...

EUVD-2026-103378

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process...

SUSE CVE-2026-111997

ip-address before 10.7.4 allows a denial of service CPU consumption from quadratic complexity, and application stall via many % characters in input reaching a function call that uses the Address6 constructor...

Linux Distros Unpatched Vulnerability : CVE-2026-111997

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip-address before 10.7.4 allows a denial of service CPU consumption from quadratic complexity, and application stall via many % characters in input reaching a...

GHSA-P3HM-X653-5RC6 Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rxp7-6hxx-x8q5. This link is maintained to preserve external references. Original Description ip-address before 10.7.4 allows a denial of service CPU consumption from quadratic complexity, and application stall...

Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rxp7-6hxx-x8q5. This link is maintained to preserve external references. Original Description ip-address before 10.7.4 allows a denial of service CPU consumption from quadratic complexity, and application stall...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the Address6 constructor in src/ipv6.ts, where the REZONESTRING regular expression...

Regular Expression Denial of Service (ReDoS)

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the Address6 constructor in src/ipv6.ts, where the REZONESTRING regular expression /%.$/ is applie...

DEBIAN-CVE-2026-111997

ip-address before 10.7.4 allows a denial of service CPU consumption from quadratic complexity, and application stall via many % characters in input reaching a function call that uses the Address6 constructor...

CVE-2026-111997

ip-address before 10.7.4 allows a denial of service CPU consumption from quadratic complexity, and application stall via many % characters in input reaching a function call that uses the Address6 constructor...

CVE-2026-111997

A flaw was found in ip-address. A remote attacker can cause a Denial of Service DoS by providing specially crafted input containing excessive percent characters to an application parsing IPv6 addresses. When processed by the Address6 constructor, inefficient parsing logic leads to high CPU...

CVE-2026-111997

ip-address before 10.7.4 allows a denial of service CPU consumption from quadratic complexity, and application stall via many % characters in input reaching a function call that uses the Address6 constructor...

CVE-2026-111997

ip-address before 10.7.4 allows a denial of service CPU consumption from quadratic complexity, and application stall via many % characters in input reaching a function call that uses the Address6 constructor...

CVE-2026-111997

The ip-address library, in versions prior to 10.7.4 , is vulnerable to a Denial of Service (DoS) condition. A remote attacker can cause high CPU consumption and application unresponsiveness by providing specially crafted input containing excessive percent (%) characters . The flaw exists because ...

CVE-2026-111997

ip-address before 10.7.4 allows a denial of service CPU consumption from quadratic complexity, and application stall via many % characters in input reaching a function call that uses the Address6 constructor...