Executive brief
Net::CIDR::Set is a Perl library used by developers to manage and manipulate sets of IP addresses and network ranges. A flaw in how the library handles malformed input can cause the application using it to enter an infinite loop. This results in a denial-of-service (DoS) condition, potentially making the affected service unresponsive to legitimate users.
Technical details
A vulnerability exists in Net::CIDR::Set through version 0.20 where the 'add' method fails to properly validate IP address inputs. When an input does not conform to expected netmask or network range formats, the internal '_encode' method assumes it is a single IP address and recursively passes it back to itself. If the input is not a well-formed IP address, this logic triggers indefinite recursion (CWE-674). An attacker providing malformed address strings to an application using this library can cause a denial of service via CPU exhaustion or stack overflow. The issue is resolved in version 0.21.
Affected products
- Perl CPAN Net::CIDR::Set through 0.20
Timeline
- 2026-06-02: patched: Version 0.21 released on CPAN
- 2026-06-04: disclosed: CVE-2026-49941 published