Net::CIDR::Set vulnerabilities
4 known CVE vulnerabilities in Net::CIDR::Set, translated and rated.
- CVE-2026-19566High
Net::CIDR::Set before 0.23 for Perl allows memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The _encode method accepts any prefix length, leading to huge allocations and incorrect range matching.
- CVE-2026-49942High
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. Unicode digits or non-digits in the mask portion were ignored, potentially allowing larger networks. Leading zeros were treated as decimal instead of octal, causing confusion.
- CVE-2026-49941High
Vulnerability in the Net::CIDR::Set library for Perl (versions up to 0.20) due to lack of IP address validation. The add method calls _encode, which for malformed addresses leads to infinite recursion, causing a denial of service.
- CVE-2026-49940Medium
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers, which could allow network masks to accept larger networks.