https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 23:42:24 +0000 https://vulnerability.circl.lu/sighting/d22b864a-544d-4c3d-82b9-43fdc9eef7a8/export {"uuid": "d22b864a-544d-4c3d-82b9-43fdc9eef7a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101911", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwqcavpxvw2z", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-101911 impacts ip-address in 4 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/705\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-09-30T12:01:05.170665Z"} {"uuid": "d22b864a-544d-4c3d-82b9-43fdc9eef7a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101911", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwqcavpxvw2z", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-101911 impacts ip-address in 4 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/705\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-09-30T12:01:05.170665Z"} https://vulnerability.circl.lu/sighting/d22b864a-544d-4c3d-82b9-43fdc9eef7a8/export Wed, 30 Sep 2026 12:01:05 +0000 https://vulnerability.circl.lu/sighting/e33194f7-ced7-4b40-a4f4-36798cd3df2c/export {"uuid": "e33194f7-ced7-4b40-a4f4-36798cd3df2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101911", "type": "seen", "source": "https://gist.github.com/alon710/8432dbe3939654e0587f7004c91b9879", "content": "# CVE-2026-101911: CVE-2026-101911: Denial of Service via Uncontrolled Resource Consumption in ip-address Library\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-101911\n\n## Summary\nA denial-of-service vulnerability exists in the ip-address npm package prior to version 10.7.1. The library fails to limit the length of input strings parsed by the Address4 and Address6 constructors. When parsing highly malformed addresses, the diagnostic parser runs a synchronous regular expression search-and-replace that generates descriptive HTML error messages. Passing an excessively long string containing invalid characters causes severe memory amplification and CPU starvation, resulting in a thread hang or process crash in Node.js applications.\n\n## TL;DR\nThe ip-address library prior to 10.7.1 is vulnerable to uncontrolled resource consumption (CWE-400). Unvalidated input length in the Address6 constructor combined with a synchronous HTML-error formatting routine allows unauthenticated remote attackers to trigger severe memory exhaustion or hard process crashes via crafted IP strings.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400 / CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS 4.0 Score**: 6.3 (Medium)\n- **EPSS Score**: 0.30% (Percentile: 20.54%)\n- **Impact**: Denial of Service (CPU Exhaustion & Process Crash)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Active\n\n## Affected Systems\n\n- Any Node.js or JavaScript application utilizing the 'ip-address' npm library versions prior to 10.7.1.\n- **ip-address**: < 10.7.1 (Fixed in: `10.7.1`)\n\n## Mitigation\n\n- Upgrade the ip-address library to version 10.7.1 or higher.\n- Implement application-level input validation limiting IP address fields to a maximum of 64 characters before parsing.\n- Configure web framework middleware (e.g., body-parser) to enforce strict global payload limits to reject multi-megabyte payloads.\n\n**Remediation Steps:**\n1. Run 'npm install ip-address@10.7.1' or update the package.json to specify version '^10.7.1'.\n2. Scan existing codebase to locate instances of 'new Address6()', 'new Address4()', and 'Address6.isValid()'.\n3. Wrap these parser calls in an validation wrapper that checks the type and restricts input length to less than 64 characters.\n\n## References\n\n- [GitHub Security Advisory GHSA-h3mg-xc3c-68pw](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw)\n- [NVD - CVE-2026-101911](https://nvd.nist.gov/vuln/detail/CVE-2026-101911)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-101911)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-101911) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T05:30:30.000000Z"} {"uuid": "e33194f7-ced7-4b40-a4f4-36798cd3df2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101911", "type": "seen", "source": "https://gist.github.com/alon710/8432dbe3939654e0587f7004c91b9879", "content": "# CVE-2026-101911: CVE-2026-101911: Denial of Service via Uncontrolled Resource Consumption in ip-address Library\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-101911\n\n## Summary\nA denial-of-service vulnerability exists in the ip-address npm package prior to version 10.7.1. The library fails to limit the length of input strings parsed by the Address4 and Address6 constructors. When parsing highly malformed addresses, the diagnostic parser runs a synchronous regular expression search-and-replace that generates descriptive HTML error messages. Passing an excessively long string containing invalid characters causes severe memory amplification and CPU starvation, resulting in a thread hang or process crash in Node.js applications.\n\n## TL;DR\nThe ip-address library prior to 10.7.1 is vulnerable to uncontrolled resource consumption (CWE-400). Unvalidated input length in the Address6 constructor combined with a synchronous HTML-error formatting routine allows unauthenticated remote attackers to trigger severe memory exhaustion or hard process crashes via crafted IP strings.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400 / CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS 4.0 Score**: 6.3 (Medium)\n- **EPSS Score**: 0.30% (Percentile: 20.54%)\n- **Impact**: Denial of Service (CPU Exhaustion & Process Crash)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Active\n\n## Affected Systems\n\n- Any Node.js or JavaScript application utilizing the 'ip-address' npm library versions prior to 10.7.1.\n- **ip-address**: < 10.7.1 (Fixed in: `10.7.1`)\n\n## Mitigation\n\n- Upgrade the ip-address library to version 10.7.1 or higher.\n- Implement application-level input validation limiting IP address fields to a maximum of 64 characters before parsing.\n- Configure web framework middleware (e.g., body-parser) to enforce strict global payload limits to reject multi-megabyte payloads.\n\n**Remediation Steps:**\n1. Run 'npm install ip-address@10.7.1' or update the package.json to specify version '^10.7.1'.\n2. Scan existing codebase to locate instances of 'new Address6()', 'new Address4()', and 'Address6.isValid()'.\n3. Wrap these parser calls in an validation wrapper that checks the type and restricts input length to less than 64 characters.\n\n## References\n\n- [GitHub Security Advisory GHSA-h3mg-xc3c-68pw](https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw)\n- [NVD - CVE-2026-101911](https://nvd.nist.gov/vuln/detail/CVE-2026-101911)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-101911)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-101911) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T05:30:30.000000Z"} https://vulnerability.circl.lu/sighting/e33194f7-ced7-4b40-a4f4-36798cd3df2c/export Wed, 30 Sep 2026 05:30:30 +0000 https://vulnerability.circl.lu/sighting/2ef9bb43-0d7b-4964-ba3d-38a08bca403d/export {"uuid": "2ef9bb43-0d7b-4964-ba3d-38a08bca403d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-101911", "type": "published-proof-of-concept", "source": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw", "content": "", "creation_timestamp": "2026-09-15T04:15:03.000000Z"} {"uuid": "2ef9bb43-0d7b-4964-ba3d-38a08bca403d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-101911", "type": "published-proof-of-concept", "source": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw", "content": "", "creation_timestamp": "2026-09-15T04:15:03.000000Z"} https://vulnerability.circl.lu/sighting/2ef9bb43-0d7b-4964-ba3d-38a08bca403d/export Tue, 15 Sep 2026 04:15:03 +0000