PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111997 beaugunderson CVE debrief

CVE-2026-111997 is a medium-severity vulnerability in the ip-address library before version 10.7.4. It allows a denial of service (CPU consumption and application stall) via many % characters in input reaching a function call that uses the Address6 constructor. The vulnerability can cause CPU consumption due to quadratic complexity, leading to performance degradation and potential application stalls. Defenders should assess exposure and prioritize updating to version 10.7.4 or later, especially in systems handling IP address inputs.

Vendor
beaugunderson
Product
ip-address
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-18
Original CVE updated
2026-10-18
Advisory published
2026-10-18
Advisory updated
2026-10-18

Who should care

Defenders responsible for systems using the ip-address library, especially those handling IP address inputs, should assess exposure and prioritize updating to version 10.7.4 or later.

Why it matters

CVE-2026-111997 is a medium-severity vulnerability in the ip-address library that can lead to denial of service. Defenders should prioritize verifying and updating the library, especially in systems handling IP address inputs, to prevent potential CPU consumption and application stalls.

  • Potential CPU consumption leading to performance degradation
  • Application stalling due to quadratic complexity in Address6 constructor
  • Need for verification of ip-address library version in use
  • Priority on updating to version 10.7.4 or later for mitigation

Technical summary

The ip-address library before version 10.7.4 is vulnerable to a denial of service attack. When the library encounters many % characters in input, it can lead to CPU consumption due to quadratic complexity in a function call using the Address6 constructor. This can cause the application to stall.

Defensive priority

Defenders should prioritize verifying and updating the ip-address library to version 10.7.4 or later, especially in systems handling IP address inputs.

Recommended defensive actions

  • Verify and update the ip-address library to version 10.7.4 or later
  • Review and limit input containing % characters in systems using the ip-address library
  • Monitor systems for CPU consumption and application stalls indicative of potential exploitation

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, additional information on affected systems and exploitation attempts is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111997 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111997

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111997 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111997

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.