CVE-2026-101911

A flaw was found in the ip-address library. A remote attacker can exploit this vulnerability by supplying an excessively large IPv6 address string to an application that parses input without length limits. The parser attempts to process the unbounded input and generate disproportionately large error diagnostics, leading to excessive memory consumption. This issue can lead to a Denial of Service (DoS) by causing the application process to stall or crash.

This vulnerability is assessed as Moderate severity because triggering service disruption requires applications to accept multi-megabyte network inputs into the address parser without front-end length restrictions. In typical Red Hat environments and standard HTTP deployments, web servers, reverse proxies, and request parsers enforce strict request size and header boundaries by default, which significantly limits the blast radius. Consequently, while malformed inputs may induce brief event-loop stalls or transient memory spikes, triggering an unhandled process termination necessitates an exceptionally large payload that is rejected under standard production configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.