Executive brief
Net::CIDR::Lite is a Perl library used to manage and filter IP address ranges. A vulnerability in how it handles network masks allows specially formatted inputs (like using leading zeros) to bypass security filters. This could allow unauthorized network traffic to reach protected systems or bypass access control lists.
Technical details
A vulnerability exists in the Net::CIDR::Lite Perl module (versions prior to 0.24) due to improper validation of CIDR mask values in the add() function. The parser accepts zero-padded masks, such as '/00' or '/032', which may be interpreted differently than intended by security filters or textual ACLs. This is an incomplete fix for a previous issue (CVE-2021-47154) and can result in an IP ACL bypass when the find() method is used to evaluate network permissions. The issue is addressed in version 0.24 by enforcing stricter decimal parsing that rejects leading zeros in masks.
Affected products
- STIGTSP Net::CIDR::Lite before 0.24
Timeline
- 2026-05-10: disclosed
- 2026-05-10: patched: Fixed in version 0.24
- 2026-05-10: advisory