diff --git a/Lib/ipaddress.py b/Lib/ipaddress.py
index d790a3dd12e75c..6ab6f99dad7a1b 100644
--- a/Lib/ipaddress.py
+++ b/Lib/ipaddress.py
@@ -1674,8 +1674,16 @@ def _ip_int_from_string(cls, ip_str):
"""
if not ip_str:
raise AddressValueError('Address cannot be empty')
+ if len(ip_str) > 39:
+ msg = ("At most 39 characters expected in "
+ f"{ip_str[:14]!r}({len(ip_str)-28} chars elided){ip_str[-14:]!r}")
+ raise AddressValueError(msg)
- parts = ip_str.split(':')
+ # We want to allow more parts than the max to be 'split'
+ # to preserve the correct error message when there are
+ # too many parts combined with '::'
+ _max_parts = cls._HEXTET_COUNT + 1
+ parts = ip_str.split(':', maxsplit=_max_parts)
# An IPv6 address needs at least 2 colons (3 parts).
_min_parts = 3
@@ -1695,7 +1703,6 @@ def _ip_int_from_string(cls, ip_str):
# An IPv6 address can't have more than 8 colons (9 parts).
# The extra colon comes from using the "::" notation for a single
# leading or trailing zero part.
- _max_parts = cls._HEXTET_COUNT + 1
if len(parts) > _max_parts:
msg = "At most %d colons permitted in %r" % (_max_parts-1, ip_str)
raise AddressValueError(msg)
diff --git a/Lib/test/test_ipaddress.py b/Lib/test/test_ipaddress.py
index f8fc7d0b59867a..7a27be16965d0b 100644
--- a/Lib/test/test_ipaddress.py
+++ b/Lib/test/test_ipaddress.py
@@ -397,6 +397,17 @@ def assertBadSplit(addr):
# A trailing IPv4 address is two parts
assertBadSplit("10:9:8:7:6:5:4:3:42.42.42.42%scope")
+ def test_bad_address_split_v6_too_long(self):
+ def assertBadSplit(addr):
+ msg = r"At most 39 characters expected in %s"
+ with self.assertAddressError(msg, repr(re.escape(addr[:14]))):
+ ipaddress.IPv6Address(addr)
+
+ # Long IPv6 address
+ long_addr = ("0:" * 10000) + "0"
+ assertBadSplit(long_addr)
+ assertBadSplit(long_addr + "%zoneid")
+
def test_bad_address_split_v6_too_many_parts(self):
def assertBadSplit(addr):
msg = "Exactly 8 parts expected without '::' in %r"
diff --git a/Misc/NEWS.d/next/Security/2025-01-14-11-19-07.gh-issue-128840.M1doZW.rst b/Misc/NEWS.d/next/Security/2025-01-14-11-19-07.gh-issue-128840.M1doZW.rst
new file mode 100644
index 00000000000000..b57ec3e70dcc5f
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2025-01-14-11-19-07.gh-issue-128840.M1doZW.rst
@@ -0,0 +1,2 @@
+Short-circuit the processing of long IPv6 addresses early in :mod:`ipaddress` to prevent excessive
+memory consumption and a minor denial-of-service.
pFad - Phonifier reborn
Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.
Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.
Alternative Proxies:
Alternative Proxy
pFad Proxy
pFad v3 Proxy
pFad v4 Proxy