Executive brief
Net::IP::LPM is a Perl library used for high-speed IP address lookups. A flaw in how it handles network prefix lengths could allow a specially crafted input to cause the application to read slightly beyond its intended memory buffer. While this is unlikely to expose sensitive data, it could cause the application to crash if security monitoring tools or hardened memory allocators are in use.
Technical details
A heap out-of-bounds read exists in Net::IP::LPM through version 1.10. The `add()` function passes a prefix string to `addPrefixToTrie()` without validating the prefix length against the address width (32 bits for IPv4, 128 bits for IPv6). An attacker providing an oversized prefix length (e.g., /255) causes the trie builder to walk the prefix buffer beyond the 4-byte or 16-byte packed address. The read is bounded to a maximum of 32 bytes due to the prefix length being stored as an unsigned char. While the out-of-bounds data is not exposed via the API, the read can trigger process termination in environments using AddressSanitizer or hardened allocators.
Affected products
- TPODER Net::IP::LPM through 1.10
Timeline
- 2026-07-03: advisory: NVD published the CVE record.