Executive brief
Net::CIDR::Lite is a Perl library used to manage and compare IP address ranges, often for security access control lists (ACLs). A flaw in how the library handles specific IPv6 addresses (IPv4-mapped IPv6) can cause it to incorrectly identify whether an IP address belongs to a restricted range. This could allow an attacker to bypass network security restrictions or gain unauthorized access to services protected by these IP-based filters.
Technical details
A vulnerability exists in the _pack_ipv6() function of Net::CIDR::Lite where it incorrectly includes a sentinel byte from _pack_ipv4() when processing IPv4-mapped IPv6 addresses (e.g., ::ffff:192.168.1.1). This results in an 18-byte packed representation instead of the expected 17 bytes, causing misalignment. Because the library uses bitwise AND operations and Perl string comparisons (lt/gt) for range matching, this misalignment leads to incorrect results in find() and bin_find() methods. An attacker can exploit this by using valid RFC 4291 IPv4-mapped addresses to bypass intended CIDR restrictions. The issue is resolved in version 0.23.
Affected products
- Stig Palmquist (STIGTSP) Net::CIDR::Lite versions before 0.23
Timeline
- 2026-04-10: disclosed
- 2026-04-10: patched: Fixed in version 0.23
- 2026-04-10: advisory