# CVE-2026-40199: Net::CIDR::Lite IP ACL bypass via IPv4-mapped IPv6 mishandling

Source: https://junglewise.ai/threats/cve-2026-40199-net-cidr-lite-ip-acl-bypass-via-ipv4-mapped-ipv6-mishandling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40199 · Severity: medium · CVSS 6.5 · Published 2026-04-10

Net::CIDR::Lite is a Perl library used to manage and compare IP address ranges, often for security access control lists (ACLs). A flaw in how the library handles specific IPv6 addresses (IPv4-mapped IPv6) can cause it to incorrectly identify whether an IP address belongs to a restricted range. This could allow an attacker to bypass network security restrictions or gain unauthorized access to services protected by these IP-based filters.

## Quick answers

**Is CVE-2026-40199 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40199 being exploited in the wild.

**How severe is CVE-2026-40199?** Medium severity, with a CVSS score of 6.5, published 10 April 2026.

**Which products and versions are affected?** Stig Palmquist (STIGTSP) Net::CIDR::Lite versions before 0.23.

**Is there a fix for CVE-2026-40199?** A patch was published on 2026-04-10: Fixed in version 0.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40199 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40199?** Check whether you run Stigtsp Net\. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the _pack_ipv6() function of Net::CIDR::Lite where it incorrectly includes a sentinel byte from _pack_ipv4() when processing IPv4-mapped IPv6 addresses (e.g., ::ffff:192.168.1.1). This results in an 18-byte packed representation instead of the expected 17 bytes, causing misalignment. Because the library uses bitwise AND operations and Perl string comparisons (lt/gt) for range matching, this misalignment leads to incorrect results in find() and bin_find() methods. An attacker can exploit this by using valid RFC 4291 IPv4-mapped addresses to bypass intended CIDR restrictions. The issue is resolved in version 0.23.

## Affected products

- Stig Palmquist (STIGTSP) Net::CIDR::Lite versions before 0.23

## Timeline

- 2026-04-10: disclosed
- 2026-04-10: patched: Fixed in version 0.23
- 2026-04-10: advisory

## References

- [https://github.com/stigtsp/Net-CIDR-Lite/commit/b7166b1fa17b3b14b4c795ace5b3fbf71a0bd04a.patch](https://github.com/stigtsp/Net-CIDR-Lite/commit/b7166b1fa17b3b14b4c795ace5b3fbf71a0bd04a.patch)
- [https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes](https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes)
- [https://www.cve.org/CVERecord?id=CVE-2026-40198](https://www.cve.org/CVERecord?id=CVE-2026-40198)

## Related threats

- [Net::CIDR::Lite IP ACL bypass via improper IPv6 validation](https://junglewise.ai/threats/cve-2026-40198-net-cidr-lite-ip-acl-bypass-via-improper-ipv6-validation)