CVE-2026-69198

Name of the Vulnerable Software and Affected Versions ip-address versions 10.1.1 through 10.2.1

Description Special-use classification methods in the library are built on the isInSubnet() function, which returns false if the address's own subnet mask is shorter than the reference range's mask. By appending a CIDR suffix such as /0 to an input address, the classification is suppressed. Consequently, methods including isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() will report internal addresses as unremarkable, even though correctForm() and address still return the actual internal target.

This can be exploited in applications that use these checks to establish network trust boundaries, such as filters designed to block Server-Side Request Forgery (SSRF). SSRF is an attack where a user-supplied address tricks the server into making requests to internal destinations, such as loopback services or cloud metadata endpoints, that the user cannot normally access.

Recommendations Update to version 10.2.2. As a temporary workaround, strip the CIDR suffix before classifying by re-parsing the addressMinusSuffix variable.