python · sethmlarson · Jan 14, 2025 · Jan 14, 2025 · Jan 14, 2025 · Jan 14, 2025
diff --git a/Lib/ipaddress.py b/Lib/ipaddress.py
@@ -1660,8 +1660,15 @@ def _ip_int_from_string(cls, ip_str):
        """
        if not ip_str:
            raise AddressValueError('Address cannot be empty')
+        if len(ip_str) > 39:
+            msg = "At most 39 characters expected in %r" % (ip_str,)
+            raise AddressValueError(msg)

-        parts = ip_str.split(':')
+        # We want to allow more parts than the max to be 'split'
+        # to preserve the correct error message when there are
+        # too many parts combined with '::'
+        _max_parts = cls._HEXTET_COUNT + 1
+        parts = ip_str.split(':', maxsplit=_max_parts)

        # An IPv6 address needs at least 2 colons (3 parts).
        _min_parts = 3
@@ -1681,7 +1688,6 @@ def _ip_int_from_string(cls, ip_str):
        # An IPv6 address can't have more than 8 colons (9 parts).
        # The extra colon comes from using the "::" notation for a single
        # leading or trailing zero part.
-        _max_parts = cls._HEXTET_COUNT + 1
        if len(parts) > _max_parts:
            msg = "At most %d colons permitted in %r" % (_max_parts-1, ip_str)
            raise AddressValueError(msg)

diff --git a/Lib/test/test_ipaddress.py b/Lib/test/test_ipaddress.py
@@ -397,6 +397,17 @@ def assertBadSplit(addr):
        # A trailing IPv4 address is two parts
        assertBadSplit("10:9:8:7:6:5:4:3:42.42.42.42%scope")

+    def test_bad_address_split_v6_too_long(self):
+        def assertBadSplit(addr):
+            msg = "At most 39 characters expected in %r"
+            with self.assertAddressError(msg, addr.split('%')[0]):
+                ipaddress.IPv6Address(addr)
+
+        # Long IPv6 address
+        long_addr = ("0:" * 10000) + "0"
+        assertBadSplit(long_addr)
+        assertBadSplit(long_addr + "%zoneid")
+
    def test_bad_address_split_v6_too_many_parts(self):
        def assertBadSplit(addr):
            msg = "Exactly 8 parts expected without '::' in %r"

diff --git a/Misc/NEWS.d/next/Security/2025-01-14-11-19-07.gh-issue-128840.M1doZW.rst b/Misc/NEWS.d/next/Security/2025-01-14-11-19-07.gh-issue-128840.M1doZW.rst
@@ -0,0 +1,2 @@
+Short-circuit the processing of long IPv6 addresses early to prevent excessive
+memory consumption and a minor denial-of-service.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Short-circuit the processing of long IPv6 addresses early to prevent excessive
		memory consumption and a minor denial-of-service.