CVE-2026-86287
UnknownSummary
A vulnerability in the Net::IP::LPM module for Perl before version 1.12 accepts malformed prefix lengths. Invalid values are treated as 0 or truncated, poisoning the lookup table and causing lookups to always succeed, so an allow-list permits all addresses and a deny-list blocks all addresses.
Risk Assessment
The risk is a complete bypass of IP-based access control mechanisms, potentially leading to unauthorized access or denial of service for all users.
Recommendation
It is recommended to upgrade Net::IP::LPM to version 1.12 or later. Also verify the correctness of list configurations after the upgrade.
Other vulnerabilities in Net::IP::LPM
See all- CVE-2026-56015Critical
Vulnerability in Net::IP::LPM for Perl before version 1.11 allows a heap out-of-bounds read via an unbounded prefix length. The add() function passes the prefix to the trie builder without checking it against the address width, leading to reads past the packed address buffer. It is detectable under AddressSanitizer, valgrind, or a hardened allocator.
- CVE-2025-40910Medium
The vulnerability in Net::IP::LPM version 1.10 for Perl improperly handles leading zero characters in IP CIDR address strings, which could allow attackers to bypass IP-based access controls. Leading zeros are interpreted as octal notation, potentially confusing users.
Original NVD description (English source)
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.