- Shipped
- 10 ஜூலை, 2026 அன்று 11:50 PM UTC
- Author
- Kamo
- Commit
- 011a73e
findByIpInRange's two-sided range predicate forced CockroachDB to scan every block with networkStart <= ip whenever the IP fell in a gap (private/bogon/ spoofed XFF) or high in the address space — measured 5-13s over the ~5.7M-row table, a spoofable DoS on any hot path. Blocks are disjoint (verified across all prod rows), so the single greatest networkStart <= ip candidate is the only possible container: fetch it with LIMIT 1 and verify networkEnd in Java. 2-4ms for both hits and misses; callers keep the exact same contract.