Skip to content

IPv6 address parsing doesn't limit buffer size #128840

Description

@sethmlarson

Bug report

Bug description:

IPv6 addresses have a maximum length (8 colon-separated parts) but the current implementation doesn't limit the length. Similar issue to django/django@ca2be77

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

Activity

  1. added
    stdlibStandard Library Python modules in the Lib/ directory
    on Jan 14, 2025
  2. added a commit that references this issue on Jan 14, 2025
  3. serhiy-storchaka commented on Jan 15, 2025

    @serhiy-storchaka
    Member

    I do not think this is a security issue.

  4. added a commit that references this issue on May 24, 2025
  5. added 6 commits that reference this issue on May 24, 2025
  6. added 2 commits that reference this issue on May 24, 2025
  7. added a commit that references this issue on May 26, 2025
  8. 29 remaining items

  9. mcepl commented on Jun 14, 2025

    @mcepl
    Contributor

    Backport of fix for this bug to Python 3.6 including rebasing ipaddress to the 3.8-level using code from phihag/ipaddress#60 is available for review in the branch https://github.com/openSUSE-Python/cpython/tree/opensuse_3.6_gh-128840_parse-IPv6-with-emb-IPv4

    If anybody is interested in review or comments, I would love to hear from you.

  10. added 2 commits that reference this issue on Jul 1, 2025
    15325b5
    025187c
  11. added 2 commits that reference this issue on Jul 12, 2025
  12. added 2 commits that reference this issue on Aug 4, 2025
  13. added 2 commits that reference this issue on Jun 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    release-blockerstdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errortype-securityA security issue

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions