VDB
CVE-2026-111997
CVE-2026-111997
PUBLISHED
CVSS 5.300000190734863 MEDIUM
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
EPSS 0.32% · 24.3th percentile
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score
0.32%
24.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | prism | 0 |
| wolfi | code-server | 0 |
| beaugunderson | ip-address | 0 |
| npm | ip-address | |
| chainguard | homepage | 0 |
| npm | ip-address | 0 |
| chainguard | lerna | 0 |
| wolfi | prism | 0 |
| chainguard | node-red | 0 |
| wolfi | npm-12 | 0 |
| wolfi | lerna | 0 |
Timeline
- Oct 18, 2026 EPSS Score
- Oct 18, 2026 Coalition ESS Score
- Oct 18, 2026 CVE Published
- Oct 19, 2026 CVE Updated
- Oct 20, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 31, 2026 Security Advisory
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-111997 advisory
- https://github.com/advisories/GHSA-rxp7-6hxx-x8q5 advisory
- https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5 url
- https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd patch
- https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4 url