Executive brief
A vulnerability in a Perl library used for managing network address ranges could allow unauthorized network access. The library fails to properly validate network masks, potentially treating restricted network ranges as much larger, open ones. This could lead to the bypass of security filters or access control lists that rely on this library to block or allow specific traffic.
Technical details
Net::CIDR::Set through version 0.20 contains an improper validation vulnerability (CWE-1289) in its network mask parsing logic. The library fails to properly handle Unicode digits (such as Arabic-Indic One) and non-digit characters in the mask portion of a CIDR string, which are ignored rather than rejected. Additionally, leading zeros in masks are treated as decimal instead of octal. These parsing inconsistencies can cause the library to interpret a restrictive network mask as a much broader one, allowing an attacker to bypass IP-based access control lists (ACLs). The issue is resolved in version 0.21.
Affected products
- Perl CPAN Net::CIDR::Set through 0.20
Timeline
- 2026-06-02: patched: Version 0.21 released on CPAN
- 2026-06-04: disclosed: CVE-2026-49942 published