Is CVE-2026-40199 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40199 being exploited in the wild.

How severe is CVE-2026-40199?

Medium severity, with a CVSS score of 6.5, published 10 April 2026.

Which products and versions are affected?

Stig Palmquist (STIGTSP) Net::CIDR::Lite versions before 0.23.

Is there a fix for CVE-2026-40199?

A patch was published on 2026-04-10: Fixed in version 0.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40199 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40199?

Check whether you run Stigtsp Net\. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40199: Net::CIDR::Lite IP ACL bypass via IPv4-mapped IPv6 mishandling

CVE-2026-40199 · Severity: medium · CVSS 6.5 · Published 2026-04-10

Net::CIDR::Lite is a Perl library used to manage and compare IP address ranges, often for security access control lists (ACLs). A flaw in how the library handles specific IPv6 addresses (IPv4-mapped IPv6) can cause it to incorrectly identify whether an IP address belongs to a restricted range. This could allow an attacker to bypass network security restrictions or gain unauthorized access to services protected by these IP-based filters.

Quick answers

Is CVE-2026-40199 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40199 being exploited in the wild.
How severe is CVE-2026-40199?: Medium severity, with a CVSS score of 6.5, published 10 April 2026.
Which products and versions are affected?: Stig Palmquist (STIGTSP) Net::CIDR::Lite versions before 0.23.
Is there a fix for CVE-2026-40199?: A patch was published on 2026-04-10: Fixed in version 0.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40199 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40199?: Check whether you run Stigtsp Net\. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the _pack_ipv6() function of Net::CIDR::Lite where it incorrectly includes a sentinel byte from _pack_ipv4() when processing IPv4-mapped IPv6 addresses (e.g., ::ffff:192.168.1.1). This results in an 18-byte packed representation instead of the expected 17 bytes, causing misalignment. Because the library uses bitwise AND operations and Perl string comparisons (lt/gt) for range matching, this misalignment leads to incorrect results in find() and bin_find() methods. An attacker can exploit this by using valid RFC 4291 IPv4-mapped addresses to bypass intended CIDR restrictions. The issue is resolved in version 0.23.

Affected products

Stig Palmquist (STIGTSP) Net::CIDR::Lite versions before 0.23

Timeline

2026-04-10: disclosed
2026-04-10: patched: Fixed in version 0.23
2026-04-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.