CVE-2026-49940
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers, which could allow network masks to accept larger networks.
Risk Assessment
Improper parsing of network masks could lead to incorrect network configuration, allowing access to a broader range of IP addresses than intended, increasing the risk of unauthorized access.
Recommendation
Update the Net::CIDR::Set library to a version later than 0.20 that includes the fix.
Other vulnerabilities in Net::CIDR::Set
See all- CVE-2026-19566High
Net::CIDR::Set before 0.23 for Perl allows memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The _encode method accepts any prefix length, leading to huge allocations and incorrect range matching.
- CVE-2026-49942High
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. Unicode digits or non-digits in the mask portion were ignored, potentially allowing larger networks. Leading zeros were treated as decimal instead of octal, causing confusion.
- CVE-2026-49941High
Vulnerability in the Net::CIDR::Set library for Perl (versions up to 0.20) due to lack of IP address validation. The add method calls _encode, which for malformed addresses leads to infinite recursion, causing a denial of service.
Original NVD description (English source)
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers. This could allow network masks to accept larger networks.