CVE-2026-45191 PUBLISHED

Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass

Assigner: CPANSec
Reserved: 10.05.2026 Published: 10.05.2026 Updated: 10.05.2026

Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.

Mask forms like "/00" and "/01" pass validation and parse to the same prefix as their unpadded value.

See also CVE-2026-45190.

Product Status

Vendor STIGTSP
Product Net::CIDR::Lite
Versions Default: unaffected
  • affected from 0 to 0.24 (excl.)

Solutions

Upgrade to version 0.24 or newer, or apply the patch provided.

References

Problem Types

  • CWE-1289 Improper Validation of Unsafe Equivalence in Input CWE