Every CVE Search/ Get API key

CVE-2026-40198

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass

7.5 HighFix available

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.

_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).

The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.

Example:

my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true

This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.

See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.32%Up 0.3 points since Apr 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.

_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).

The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.

Example:

my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true

This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.

See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

Record
CVE-2026-40198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-1286
Updated
2026-11-02
EUVDEUVD-2026-21609 7.5

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.

_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).

The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.

Example:

my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true

This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.

See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

Record
EUVD-2026-21609
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-c25q-mqx5-m6v8 7.5

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow...

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.

_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).

The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.

Example:

my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true

This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.

See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

Record
GHSA-c25q-mqx5-m6v8
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-1286
Updated
2026-11-02
NVD 7.5

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.

_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).

The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.

Example:

my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true

This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.

See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

Record
CVE-2026-40198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-1286
Updated
2026-11-02
OSVALPINE-CVE-2026-40198 7.5

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.

_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).

The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.

Example:

my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true

This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.

See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

Record
ALPINE-CVE-2026-40198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSV 7.5

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.

_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).

The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.

Example:

my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true

This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.

See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

Record
CVE-2026-40198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-1286
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2026-40198 7.5

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass. _pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17). The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range. Example: my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module. See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

Record
DEBIAN-CVE-2026-40198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-40198 7.5

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass. _pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17). The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range. Example: my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module. See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

Record
UBUNTU-CVE-2026-40198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVAZL-82739 No score

CVE-2026-40198 affecting package perl-Net-CIDR-Lite 0.22-2

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.

_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).

The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.

Example:

my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true

This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.

See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

Record
AZL-82739
Updated
2026-11-05
OSVMGASA-2026-0115 No score

Updated perl-Net-CIDR-Lite packages fix security vulnerabilities

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass. (CVE-2026-40198) Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. (CVE-2026-40199)

Record
MGASA-2026-0115
Updated
2026-11-02
OSVopenSUSE-SU-2026:10780-1 No score

perl-Net-CIDR-Lite-0.240.0-1.1 on GA media

These are all security issues fixed in the perl-Net-CIDR-Lite-0.240.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10780-1
Updated
2026-11-02
OSVSUSE-SU-2026:2113-1 No score

Security update for perl-Net-CIDR-Lite

This update for perl-Net-CIDR-Lite fixes the following issues

  • CVE-2026-45190: improper validation of trailing newlines or non-ASCII digits can lead to IP ACL bypass (bsc#1264710).
  • CVE-2026-45191: extraneous leading zeros in CIDR mask values can lead to IP ACL bypass (bsc#1264709).
  • CVE-2026-40198: missing validation for the IPv6 group count can lead to IP ACL bypass (bsc#1262088).
  • CVE-2026-40199: mishandled IPv4 mapped IPv6 addresses can lead to IP ACL bypass (bsc#1262088).
Record
SUSE-SU-2026:2113-1
Updated
2026-11-02
OSVUSN-8406-1 No score

libnet-cidr-lite-perl vulnerabilities

Dave Rolsky discovered that Net::CIDR::Lite did not properly handle extraneous zero characters at the beginning of an IP address string. A remote attacker could possibly use this issue to bypass access controls that are based on IP addresses. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-47154)

It was discovered that Net::CIDR::Lite did not properly validate the IPv6 group count when handling uncompressed IPv6 addresses. A remote attacker could possibly use this issue to bypass access controls. (CVE-2026-40198)

It was discovered that Net::CIDR::Lite mishandled IPv4 mapped IPv6 addresses. A remote attacker could possibly use this issue to bypass access controls that are based on IP addresses. (CVE-2026-40199)

Record
USN-8406-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
perl-net-cidr-lite
Alpine:v3.21
 before 0.23-r0
0.23-r0
perl-net-cidr-lite
Alpine:v3.22
 before 0.23-r0
0.23-r0
perl-net-cidr-lite
Alpine:v3.23
 before 0.23-r0
0.23-r0
perl-net-cidr-lite
Alpine:v3.24
 before 0.23-r0
0.23-r0
perl-Net-CIDR-Lite
Azure Linux:3
 through 0.22-2 None known
libnet-cidr-lite-perl
Debian:12
 before 0.22-3~deb12u1, plus listed versions
0.22-2
0.22-3~deb12u1
libnet-cidr-lite-perl
Debian:13
 before 0.22-3~deb13u1, plus listed versions
0.22-20.22-3~deb12u10.22-3~deb12u2
0.22-3~deb13u1
libnet-cidr-lite-perl
Debian:14
 before 0.22-3, plus listed versions
0.22-20.22-3~deb12u10.22-3~deb12u20.22-3~deb13u10.22-3~deb13u2
0.22-3
perl-Net-CIDR-Lite
Mageia:9
From an advisory covering 2 CVEs
 before 0.230.0-1.mga9
0.230.0-1.mga9
libnet-cidr-lite-perl
Ubuntu:Pro:16.04:LTS
 before 0.21-1ubuntu0.16.04.1~esm1, plus listed versions
0.21-1
0.21-1ubuntu0.16.04.1~esm1
Show 14 moreShow less
Affected packages
PackageAffectedFixed
libnet-cidr-lite-perl
Ubuntu:Pro:18.04:LTS
 before 0.21-1ubuntu0.18.04.1~esm1, plus listed versions
0.21-1
0.21-1ubuntu0.18.04.1~esm1
libnet-cidr-lite-perl
Ubuntu:Pro:20.04:LTS
 before 0.21-2ubuntu0.1+esm1, plus listed versions
0.21-20.21-2ubuntu0.1
0.21-2ubuntu0.1+esm1
libnet-cidr-lite-perl
Ubuntu:22.04:LTS
 before 0.22-1ubuntu0.1, plus listed versions
0.22-1
0.22-1ubuntu0.1
libnet-cidr-lite-perl
Ubuntu:24.04:LTS
 before 0.22-2ubuntu0.24.04.1, plus listed versions
0.22-2
0.22-2ubuntu0.24.04.1
libnet-cidr-lite-perl
Ubuntu:25.10
 before 0.22-2ubuntu0.25.10.1, plus listed versions
0.22-2
0.22-2ubuntu0.25.10.1
libnet-cidr-lite-perl
Ubuntu:26.04:LTS
 before 0.22-2ubuntu0.26.04.1, plus listed versions
0.22-2
0.22-2ubuntu0.26.04.1
libnet-cidr-lite-perl
Ubuntu:Pro:16.04:LTS
From an advisory covering 3 CVEs
 before 0.21-1ubuntu0.16.04.1~esm1, plus listed versions
0.21-1
0.21-1ubuntu0.16.04.1~esm1
libnet-cidr-lite-perl
Ubuntu:Pro:18.04:LTS
From an advisory covering 3 CVEs
 before 0.21-1ubuntu0.18.04.1~esm1, plus listed versions
0.21-1
0.21-1ubuntu0.18.04.1~esm1
libnet-cidr-lite-perl
Ubuntu:Pro:20.04:LTS
From an advisory covering 3 CVEs
 before 0.21-2ubuntu0.1+esm1, plus listed versions
0.21-20.21-2ubuntu0.1
0.21-2ubuntu0.1+esm1
libnet-cidr-lite-perl
Ubuntu:22.04:LTS
From an advisory covering 3 CVEs
 before 0.22-1ubuntu0.1, plus listed versions
0.22-1
0.22-1ubuntu0.1
libnet-cidr-lite-perl
Ubuntu:24.04:LTS
From an advisory covering 3 CVEs
 before 0.22-2ubuntu0.24.04.1, plus listed versions
0.22-2
0.22-2ubuntu0.24.04.1
libnet-cidr-lite-perl
Ubuntu:25.10
From an advisory covering 3 CVEs
 before 0.22-2ubuntu0.25.10.1, plus listed versions
0.22-2
0.22-2ubuntu0.25.10.1
libnet-cidr-lite-perl
Ubuntu:26.04:LTS
From an advisory covering 3 CVEs
 before 0.22-2ubuntu0.26.04.1, plus listed versions
0.22-2
0.22-2ubuntu0.26.04.1
perl-Net-CIDR-Lite
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 0.240.0-1.1
0.240.0-1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40198 is a high vulnerability (CVSS 7.5) in Stigtsp Net::cidr::lite, published April 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in perl-net-cidr-lite 0.23-r0.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open