CVE-2026-56015
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Vulnerability in Net::IP::LPM for Perl before version 1.11 allows a heap out-of-bounds read via an unbounded prefix length. The add() function passes the prefix to the trie builder without checking it against the address width, leading to reads past the packed address buffer. It is detectable under AddressSanitizer, valgrind, or a hardened allocator.
Risk Assessment
The risk includes potential process termination (crash) during trie construction, which could lead to denial of service. Since the out-of-bounds bytes are not exposed through the module's API, the risk of information disclosure is limited.
Recommendation
Update Net::IP::LPM to version 1.11 or later, which includes the fix. Additionally, test applications using this module with memory error detection tools.
Other vulnerabilities in Net::IP::LPM
See all- CVE-2026-86287High
A vulnerability in the Net::IP::LPM module for Perl before version 1.12 accepts malformed prefix lengths. Invalid values are treated as 0 or truncated, poisoning the lookup table and causing lookups to always succeed, so an allow-list permits all addresses and a deny-list blocks all addresses.
- CVE-2025-40910Medium
The vulnerability in Net::IP::LPM version 1.10 for Perl improperly handles leading zero characters in IP CIDR address strings, which could allow attackers to bypass IP-based access controls. Leading zeros are interpreted as octal notation, potentially confusing users.
Original NVD description (English source)
Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length. add() passes the prefix string to the trie builder addPrefixToTrie() without checking it against the address width. addPrefixToTrie() then walks the prefix buffer by prefix_length bits, reading prefix[byte] for byte up to prefix_len/8, where prefix is the 4-byte (IPv4) or 16-byte (IPv6) packed address. A prefix length greater than 32 for IPv4 or 128 for IPv6, for example add("1.2.3.4/255", $v) or add("2001:db8::/255", $v), reads past the end of the packed address. The out-of-bounds read happens during trie construction and is bounded: the prefix length is stored as an unsigned char, so the bit walk reads at most 32 bytes from the start of the packed address, a short distance past the end of the 4-byte or 16-byte buffer. It is detectable under AddressSanitizer, valgrind, or a hardened allocator, where it can abort the process. Lookups and dump() format only the valid address width, so the out-of-bounds bytes are not exposed through the module's API.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS