Executive brief
Net::IP::LPM is a Perl library for performing longest-prefix-match lookups on IP address ranges, commonly used in firewall rules and access control lists. The vulnerability allows attackers to bypass or corrupt access control policies by supplying malformed prefix lengths that are silently accepted as zero, causing allow-lists to permit all traffic and deny-lists to block all traffic.
Technical details
The vulnerability is an input validation flaw in Net::IP::LPM versions before 1.12. Non-numeric and non-ASCII prefix lengths are accepted and silently treated as zero, and integer values exceeding 31 bits are truncated rather than rejected. When a malformed prefix is added to the lookup table, it poisons the trie structure, causing all subsequent lookups to silently succeed regardless of the actual prefix match. An attacker can craft CIDR notation with invalid prefix lengths (e.g., "10.0.0.0/abc" or "10.0.0.0/4294967296") that the library will process, corrupting the lookup table. The fix (version 1.12+) adds strict validation: prefix lengths must be decimal integers and must be within valid ranges (0–32 for IPv4, 0–128 for IPv6).
Affected products
- Perl Net::IP::LPM before 1.12
Timeline
- 2026-09-07: disclosed
- 2026-09-06: patched: Version 1.12 released with fix