Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-50570: IPAddress v5.1.0 Can Get Stuck in a Loop with Bad Input

CVE-2023-50570 · published 2 years ago

Summary

The IPAddress component in version 5.1.0 of the software can enter an infinite loop if it's given incorrect data. This is only a concern if you're passing it bad information. To stay safe, make sure you're only feeding it valid data.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	github	com.github.seancfoley:ipaddress	<= 5.4.0
–	seancfoley	ipaddress	5.1.0 `cpe:2.3:a:seancfoley:ipaddress:5.1.0:::::::*`

Original advisory text

An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop. This is disputed because an infinite loop occurs only for cases in which the developer supplies invali...

References

https://github.com/seancfoley/IPAddress/issues/118#issuecomment-1876043773
https://github.com/github/advisory-database/pull/3279
https://github.com/advisories/GHSA-qphf-w3cq-jpmx
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50570... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-50570 Vendor Advisory
https://github.com/seancfoley/IPAddress/issues/118 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')

Timeline

Published29 Dec 2023

Updated3 Nov 2026

First seen6 Mar 2026

Sources

GHSA-qphf-w3cq-jpmx · GHSA

CVE-2023-50570 · NVD

CVE-2023-50570 · OSV

Track software like this

Free during beta