CVE-2026-101913 ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

EUVD-2026-88399

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

CVE-2026-101912

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whos...

CVE-2026-101911 ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

EUVD-2026-88395

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through REBADCHARACTERS into large diagnostics. Material...

CVE-2026-101911

The ip-address JavaScript library (versions prior to 10.7.1 ) is vulnerable to a Denial of Service (DoS) condition. The Address6 constructor , Address6.isValid , and the parse code in src/ipv6.ts accept unbounded strings and expand invalid characters via RE_BAD_CHARACTERS into large diagnostics. ...

CVE-2026-101910

The ip-address JavaScript library (versions 10.2.0 through 10.5.1 ) contains a logic flaw in the Address6 isPrivate classifier located in src/ipv6.ts. Specifically, it fails to recognize the NAT64 local-use range 64:ff9b:1::/48. This allows applications that rely on isPrivate, isLoopback, and isL...

CVE-2026-101910 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

CVE-2026-101910 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

CVE-2026-101910 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

EUVD-2026-88394

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

CVE-2020-16898

CVE-2020-16898: “坏邻居” CVSS 评分: 8.8 CVSS 向量: CVSS3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 概述 10月13日，微软宣布 Windows IPv6 协议栈中存在一个极其严重的漏洞，该漏洞允许攻击者发送特制数据包，从而可能在远程系统上执行任意代码。分享给 MAPP 成员的概念验证代码既极其简单又完全可靠。它会立即导致蓝屏死机（BSOD），但更重要的是，对于那些能够绕过 Windows 10 和 Windows Server 2019...

MGASA-2026-0458 Updated php package fixes security vulnerabilities

FILTERSANITIZEENCODED does not encode 0xFF IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison Various packet overreads in mysqlnd wire protocol TLS hostname verification falls back to CN after SAN mismatch Heap buffer overflow in phpopensslmatcheswildcardname on...

CVE-2024-38063-POC

Enviador de Paquetes de Vulnerabilidad IPv6 para Corrupción de Memoria CVE-2024-38063 Este script de Python está diseñado para enviar paquetes diseñados para desencadenar posibles vulnerabilidades de corrupción de memoria CVE-2024-38063. Utiliza la biblioteca Scapy para crear y enviar paquetes...

CVE-2024-38063

Este es un PoC bastante inestable para CVE-2024-38063, un RCE en tcpip.sys parcheado el 13 de agosto de 2024. Yo no encontré ni reporté esta vulnerabilidad; eso fue Wei. requisitos pip3 install scapy uso Modifica los campos en el script: iface - Si tienes varios adaptadores, necesitas elegir cuál...

sylkie

sylkie A command line tool and library for testing networks for common address spoofing security vulnerabilities in IPv6 networks using the Neighbor Discovery Protocol. Getting Started Note: This project is still in the early phases of development. If you run into any problems, please consider...

CVE-2022-21907

CVE-2022-21907 Un exploit DoS real para CVE-2022-21907 Soporta IPv4/IPv6/HTTP/HTTPS Sistemas afectados - Windows - 10 Versión 1809 para sistemas de 32 bits - 10 Versión 1809 para sistemas basados en x64 - 10 Versión 1809 para sistemas basados en ARM64 - 10 Versión 21H1 para sistemas de 32 bits - ...

CVE-2025-7775

CVE-2025-7775 Vulnerabilidad de desbordamiento de memoria que conduce a ejecución remota de código y/o denegación de servicio en NetScaler ADC y NetScaler Gateway cuando NetScaler está configurado como Gateway servidor virtual VPN, proxy ICA, CVPN, proxy RDP o servidor virtual AAA o NetScaler ADC...

CVE-2024-38063-scanner

概述 此项目是一个 Python 脚本，利用 Shodan 进行侦察、Scapy 构造和发送恶意 IPv6 数据包，以识别并利用易受攻击的 Windows 系统，针对 CVE-2024-38063 漏洞。该工具自动化了搜索易受攻击主机、验证其受影响情况以及执行拒绝服务（DoS）攻击以引发蓝屏死机（BSOD）的过程。 CVE-2024-38063 详解 CVE-2024-38063 是某些版本 Windows 操作系统中发现的一个严重漏洞。该漏洞源于对 IPv6 邻居发现（ND）数据包（特别是分片 IPv6 数据包的处理）的不当处理。攻击者可通过发送特制的 IPv6 数据包利用此缺陷，导致...

CVE-2024-38063

CVE-2024-38063 - Explotando el kernel de forma remota mediante IPv6 Desde que cayó el último parche de Windows el 13 de agosto, he estado metido de lleno en tcpip.sys el controlador del kernel responsable de manejar los paquetes TCP/IP. Una vulnerabilidad con una puntuación CVSS de 9.8 en la part...