Executive brief
A vulnerability exists in a Perl library used for managing and matching IP address ranges. The software incorrectly accepts non-standard characters (such as Arabic-Indic digits) in network addresses, which can lead to the library miscalculating the size of a network. This could allow unauthorized traffic to bypass security filters or access restricted network segments that were intended to be blocked.
Technical details
The Net::CIDR::Set library suffers from improper validation of unsafe equivalence in input (CWE-1289). Specifically, it accepts Unicode digits, such as Arabic-Indic One (U+0661), in IP address and netmask strings but fails to parse them correctly as numeric values. This flaw can cause the library to interpret a network mask as being larger than intended. An attacker could potentially exploit this to bypass IP-based access control lists (ACLs) or security filters that rely on this library for CIDR matching. The issue is fixed in version 0.21.
Affected products
- Perl CPAN Net::CIDR::Set through 0.20
Timeline
- 2026-06-02: patched: Version 0.21 released with security fixes.
- 2026-06-04: disclosed: CVE-2026-49940 published.