CVE-2026-86287 PUBLISHED

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

Assigner: CPANSec
Reserved: 06.09.2026 Published: 07.09.2026 Updated: 07.09.2026

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.

Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table.

The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.

Product Status

Package Collection https://cpan.org/modules
Package Name Net-IP-LPM
Versions Default: unaffected
  • affected from 0 to 1.12 (excl.)

Solutions

Upgrade to Net::IP::LPM version 1.12 or later.

References

Problem Types

  • CWE-1287 Improper Validation of Specified Type of Input CWE