CVE-2026-111997: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

new Address6() and Address6.isValid() strip a zone identifier with the pattern /%.*$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before failing, so rejecting the string takes time proportional to the square of its length. 10,000 % characters and a newline take 41 ms, 40,000 take 632 ms and 100,000 take 3.9 s of synchronous work. The same strings without the newline are rejected in under a millisecond.

An application that validates an attacker-supplied string with these methods can be stalled by a single long request. The input is rejected with the correct AddressError; the cost of reaching that rejection is the defect.