IP
Product
ip-address
9
CVEs
0
On KEV
7.7
Max CVSS
1
New 30D
Severity mix
Critical 0High 1Medium 8Low 0
Watch
Add ip-address to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-101910 | 6.9 | Sep 28 | ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass Affected: >= 10.2.0, < 10.5.1 |
| CVE-2026-69198 | 6.9 | Aug 3 | ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks Affected: >= 10.1.1, < 10.2.2 |
| CVE-2026-54272 | 6.9 | Jul 27 | ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks Affected: >= 10.1.1, < 10.2.1 |
| CVE-2026-111997 | 6.3 | Oct 18 | ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that… Affected: before 10.7.4 |
| CVE-2026-101913 | 6.3 | Sep 28 | ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts Affected: < 10.5.1 |
| CVE-2026-101912 | 6.3 | Sep 28 | ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range Affected: < 10.7.1 |
| CVE-2026-101911 | 6.3 | Sep 28 | ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process Affected: < 10.7.1 |
| CVE-2026-42338 | 6.1 | May 12 | ip-address: XSS in Address6 HTML-emitting methods Affected: < 10.1.1 |
Showing 8