CVE-2026-49942
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. Unicode digits or non-digits in the mask portion were ignored, potentially allowing larger networks. Leading zeros were treated as decimal instead of octal, causing confusion.
Risk Assessment
Improper network mask validation could allow an attacker to access broader IP ranges than intended, potentially leading to unauthorized network access.
Recommendation
Update the Net::CIDR::Set library to the latest available version that includes mask validation fixes.
Other vulnerabilities in Net::CIDR::Set
See all- CVE-2026-19566High
Net::CIDR::Set before 0.23 for Perl allows memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The _encode method accepts any prefix length, leading to huge allocations and incorrect range matching.
- CVE-2026-49941High
Vulnerability in the Net::CIDR::Set library for Perl (versions up to 0.20) due to lack of IP address validation. The add method calls _encode, which for malformed addresses leads to infinite recursion, causing a denial of service.
- CVE-2026-49940Medium
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers, which could allow network masks to accept larger networks.
Original NVD description (English source)
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks. Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable.