gh-128840: Limit the number of parts in IPv6 address parsing

Lib/ipaddress.py

@@ -1661,7 +1661,11 @@ def _ip_int_from_string(cls, ip_str):
         if not ip_str:
             raise AddressValueError('Address cannot be empty')
 
-        parts = ip_str.split(':')
+        # We want to allow more parts than the max to be 'split'
+        # to preserve the correct error message when there are
+        # too many parts combined with '::'
+        _max_parts = cls._HEXTET_COUNT + 1
+        parts = ip_str.split(':', maxsplit=_max_parts)
 
         # An IPv6 address needs at least 2 colons (3 parts).
         _min_parts = 3
@@ -1681,7 +1685,6 @@ def _ip_int_from_string(cls, ip_str):
         # An IPv6 address can't have more than 8 colons (9 parts).
         # The extra colon comes from using the "::" notation for a single
         # leading or trailing zero part.
-        _max_parts = cls._HEXTET_COUNT + 1
         if len(parts) > _max_parts:
             msg = "At most %d colons permitted in %r" % (_max_parts-1, ip_str)
             raise AddressValueError(msg)

Lib/test/test_ipaddress.py

@@ -396,6 +396,8 @@ def assertBadSplit(addr):
         assertBadSplit("8:7:6:5:4:3:2:1::%scope")
         # A trailing IPv4 address is two parts
         assertBadSplit("10:9:8:7:6:5:4:3:42.42.42.42%scope")
+        # Long IPv6 address
+        assertBadSplit(("0:" * 10000) + "0")
 
     def test_bad_address_split_v6_too_many_parts(self):
         def assertBadSplit(addr):

Misc/NEWS.d/next/Security/2025-01-14-11-19-07.gh-issue-128840.M1doZW.rst

@@ -0,0 +1 @@
+Limit the number of parts split during IPv6 address parsing.