CVE-2026-49941
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Vulnerability in the Net::CIDR::Set library for Perl (versions up to 0.20) due to lack of IP address validation. The add method calls _encode, which for malformed addresses leads to infinite recursion, causing a denial of service.
Risk Assessment
Risk of DoS attack by sending a malformed IP address, potentially exhausting resources and crashing the application.
Recommendation
Update the Net::CIDR::Set library to a version later than 0.20 or apply patches that validate IP addresses.
Other vulnerabilities in Net::CIDR::Set
See all- CVE-2026-19566High
Net::CIDR::Set before 0.23 for Perl allows memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The _encode method accepts any prefix length, leading to huge allocations and incorrect range matching.
- CVE-2026-49942High
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. Unicode digits or non-digits in the mask portion were ignored, potentially allowing larger networks. Leading zeros were treated as decimal instead of octal, causing confusion.
- CVE-2026-49940Medium
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers, which could allow network masks to accept larger networks.
Original NVD description (English source)
Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. The add method called the _encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and passed back to itself as a 32-bit or 128-bit netmask. If the argument was not a well-formed IP address, then this would lead to indefinite recursion. An attacker could use this to cause a denial of service.