ip-address CVE-2026-101913

Exploitation requires that the consuming application call Address6.isLinkLocal() and use its result as a trust-boundary or access-control decision (e.g. an SSRF or on-link filter that treats link-local addresses specially). The attacker must be able to supply an attacker-controlled IPv6 address that lies in fe80::/10 but outside the narrower fe80::/64 that the buggy method matched. Limiting factors: the flaw is inert if no security decision depends on isLinkLocal (the AT:P attack requirement); the vulnerable versions are <10.5.1; and impact is confined to confidentiality/reachability of an on-link host, with no integrity or availability effect.

This is a moderate, logic-level trust-boundary flaw rather than a directly exploitable memory or RCE bug. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L, base 6.3) reports network reach with no privileges or user interaction, but critically includes AT:P (Attack Requirements: Present) - signaling that exploitation depends on specific preconditions, namely that the consuming application actually uses Address6.isLinkLocal() as a security/trust decision. The CWE-697 (incorrect comparison) classification matches the root cause: isLinkLocal recognized only fe80::/64 instead of the full fe80::/10 link-local range. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so exploitation status is 'no public exploit identified.' The real-world risk is a function of downstream usage, not of the library alone: the impact is limited (VC:L/SC:L, confidentiality-only, no integrity or availability), and the flaw is inert unless an application relies on this exact method for an allow/deny filter. This is best treated as a widely-distributed-but-narrow-trigger issue - patch it because the library is popular and updating is cheap, not because of imminent mass exploitation. Note the vendor tags this 'Authentication Bypass' while the actual mechanism is a filter/trust-boundary bypass via incorrect range comparison, not credential bypass - verify semantics before triaging as auth-related.

An application uses ip-address's Address6.isLinkLocal() as a trust-boundary or SSRF-style filter, assuming any link-local address is caught. An attacker supplies an IPv6 address within fe80::/10 but outside fe80::/64 (e.g. fe8f::...); the buggy check returns false, so the address is treated as non-link-local and permitted, allowing the attacker to reach an on-link host outside the intended trust boundary. No public exploit code is known, and success requires the target app to depend on this specific method for its security decision.