VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 29, 2023· Updated Sep 3, 2024

CVE-2023-50570

CVE-2023-50570

Description

An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop. This is disputed because an infinite loop occurs only for cases in which the developer supplies invalid arguments. The product is not intended to always halt for contrived inputs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A bug in IPAddress v5.1.0's IPAddressBitsDivision can cause an infinite loop when provided with invalid arguments, though the developer disputes this as by-design behavior for contrived inputs.

Vulnerability

Description The IPAddress library version 5.1.0 contains an issue in the IPAddressBitsDivision component that can cause an infinite loop when supplied with invalid arguments [1]. Specifically, passing certain long and integer values to the constructor leads to a non-terminating computation [3].

Exploitation

Conditions An attacker could exploit this by providing crafted input to methods that utilize IPAddressBitsDivision, such as equals() [3]. No authentication is required if the library processes external data. The developer notes that the library is not intended to handle contrived inputs, and the infinite loop occurs only for invalid arguments [4].

Impact

Successful exploitation results in a denial-of-service condition due to the infinite loop, potentially affecting application availability [1].

Mitigation

Users should upgrade to a newer version of the IPAddress library (e.g., 5.6.2) where the issue may be resolved [2]. Alternatively, ensure that only valid arguments are passed to the library.

References
  1. NVD - CVE-2023-50570
  2. GitHub - seancfoley/IPAddress: Java library for handling IP addresses and subnets, both IPv4 and IPv6
  3. new IPAddressBitsDivision leads to infinite loop
  4. new IPAddressBitsDivision leads to infinite loop

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.github.seancfoley:ipaddressMaven
<= 5.4.0—

Affected products

137

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.