{"id":"CVE-2026-111997","title":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","summary":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-1333"],"vendor":"beaugunderson","product":"ip-address","affected":["ip-address < 10.7.4"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-18T11:12:34.844670Z"},"exploitAvailable":true,"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T11:12:55.202Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111997","references":[{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-10-18T01:27:58.672Z","epss":0.00253,"epssPercentile":0.15636,"slug":"CVE-2026-111997","body":"## Overview\n\nip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.\n\n## Affected\n\n- `ip-address < 10.7.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":224030,"id":"CVE-2026-111997","ts":1792323683670,"field":"exploit_available","old":"false","new":"true"}]}