ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111997 · Microsoft / collected KEV context

EUVD-2026-103378

GHSA-p3hm-x653-5rc6

GHSA-rxp7-6hxx-x8q5

cve-program · CVE-2026-111997

• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5

euvd · EUVD-2026-103378

• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5

nvd · CVE-2026-111997

• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5

osv · GHSA-p3hm-x653-5rc6

• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5
• https://nvd.nist.gov/vuln/detail/CVE-2026-111997

osv · GHSA-rxp7-6hxx-x8q5

• https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5
• https://nvd.nist.gov/vuln/detail/CVE-2026-111997
• https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd
• https://github.com/beaugunderson/ip-address
• https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4

No related operational record is retained in the current change model.