# CVE-2026-45190: STIGTSP Net::CIDR::Lite IP ACL bypass via improper input validation

Source: https://junglewise.ai/threats/cve-2026-45190-stigtsp-net-cidr-lite-ip-acl-bypass-via-improper-input-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-45190 · Severity: medium · CVSS 6.5 · Published 2026-05-10

A vulnerability in the Net::CIDR::Lite Perl library, which is used to manage and compare IP address ranges, could allow attackers to bypass security access controls. By providing specially crafted IP addresses containing hidden characters like newlines or non-standard digits, an attacker can trick the system into misidentifying their network location. This could result in unauthorized access to services or data that are supposed to be restricted to specific IP addresses.

Technologies: [CPAN Net::CIDR::Lite](https://junglewise.ai/threats/technologies/net-cidr-lite). Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-45190 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45190 being exploited in the wild.

**How severe is CVE-2026-45190?** Medium severity, with a CVSS score of 6.5, published 10 May 2026.

**Which products and versions are affected?** CPAN Net::CIDR::Lite < 0.24.

**Is there a fix for CVE-2026-45190?** A patch was published on 2026-05-10: Fixed in version 0.24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45190 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45190?** Check whether you run CPAN Net::CIDR::Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Net::CIDR::Lite versions before 0.24 contain an input validation flaw where the parser regexes use \d (which matches Unicode digits) and /^...$/ (which allows trailing newlines). These inputs pass initial validation but are subsequently re-encoded by the parser into different addresses than intended. Consequently, the find() and bin_find() methods may return incorrect results, leading to IP ACL bypasses. An attacker can exploit this by providing malformed IP strings that the library incorrectly matches against allowed ranges. The issue is fixed in version 0.24 by using stricter regex anchors (\A and \z) and limiting digit matching to [0-9].

## Affected products

- STIGTSP Net::CIDR::Lite before 0.24

## Timeline

- 2026-05-10: disclosed
- 2026-05-10: patched: Fixed in version 0.24
- 2026-05-10: advisory

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch](https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch)
- [https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes](https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes)
- [https://www.cve.org/CVERecord?id=CVE-2026-45191](https://www.cve.org/CVERecord?id=CVE-2026-45191)