CVE-2025-40910
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The vulnerability in Net::IP::LPM version 1.10 for Perl improperly handles leading zero characters in IP CIDR address strings, which could allow attackers to bypass IP-based access controls. Leading zeros are interpreted as octal notation, potentially confusing users.
Risk Assessment
The organization may face access control bypass if systems rely on IP address matching against allow/deny lists and an attacker uses an IP address with leading zeros.
Recommendation
Update the Net::IP::LPM library to the latest version that correctly handles leading zeros, or implement additional IP address validation before processing.
Other vulnerabilities in Net::IP::LPM
See all- CVE-2026-86287Unknown
A vulnerability in the Net::IP::LPM module for Perl before version 1.12 accepts malformed prefix lengths. Invalid values are treated as 0 or truncated, poisoning the lookup table and causing lookups to always succeed, so an allow-list permits all addresses and a deny-list blocks all addresses.
- CVE-2026-56015Critical
Vulnerability in Net::IP::LPM for Perl before version 1.11 allows a heap out-of-bounds read via an unbounded prefix length. The add() function passes the prefix to the trie builder without checking it against the address width, leading to reads past the packed address buffer. It is detectable under AddressSanitizer, valgrind, or a hardened allocator.
Original NVD description (English source)
Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation.