Every CVE Search/ Get API key

CVE-2026-40199

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass

6.5 MediumFix available

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.

_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.

The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.

Example:

my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true

This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).

See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.31%Up 0.3 points since Apr 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.

_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.

The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.

Example:

my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true

This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).

See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

Record
CVE-2026-40199
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-130
Updated
2026-11-02
EUVDEUVD-2026-21611 6.5

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.

_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.

The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.

Example:

my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true

This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).

See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

Record
EUVD-2026-21611
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-932w-96j4-j35v 6.5

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may...

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.

_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.

The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.

Example:

my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true

This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).

See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

Record
GHSA-932w-96j4-j35v
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-130
Updated
2026-11-02
NVD 6.5

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.

_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.

The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.

Example:

my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true

This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).

See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

Record
CVE-2026-40199
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-130
Updated
2026-11-02
OSVALPINE-CVE-2026-40199 6.5

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.

_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.

The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.

Example:

my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true

This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).

See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

Record
ALPINE-CVE-2026-40199
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSV 6.5

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.

_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.

The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.

Example:

my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true

This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).

See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

Record
CVE-2026-40199
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-130
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2026-40199 6.5

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. _pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address. The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses. Example: my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x). See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

Record
DEBIAN-CVE-2026-40199
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-40199 6.5

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. _pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address. The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses. Example: my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x). See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

Record
UBUNTU-CVE-2026-40199
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVAZL-82742 No score

CVE-2026-40199 affecting package perl-Net-CIDR-Lite 0.22-2

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.

_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.

The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.

Example:

my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true

This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).

See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

Record
AZL-82742
Updated
2026-11-05
OSVMGASA-2026-0115 No score

Updated perl-Net-CIDR-Lite packages fix security vulnerabilities

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass. (CVE-2026-40198) Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. (CVE-2026-40199)

Record
MGASA-2026-0115
Updated
2026-11-02
OSVopenSUSE-SU-2026:10780-1 No score

perl-Net-CIDR-Lite-0.240.0-1.1 on GA media

These are all security issues fixed in the perl-Net-CIDR-Lite-0.240.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10780-1
Updated
2026-11-02
OSVSUSE-SU-2026:2113-1 No score

Security update for perl-Net-CIDR-Lite

This update for perl-Net-CIDR-Lite fixes the following issues

  • CVE-2026-45190: improper validation of trailing newlines or non-ASCII digits can lead to IP ACL bypass (bsc#1264710).
  • CVE-2026-45191: extraneous leading zeros in CIDR mask values can lead to IP ACL bypass (bsc#1264709).
  • CVE-2026-40198: missing validation for the IPv6 group count can lead to IP ACL bypass (bsc#1262088).
  • CVE-2026-40199: mishandled IPv4 mapped IPv6 addresses can lead to IP ACL bypass (bsc#1262088).
Record
SUSE-SU-2026:2113-1
Updated
2026-11-02
OSVUSN-8406-1 No score

libnet-cidr-lite-perl vulnerabilities

Dave Rolsky discovered that Net::CIDR::Lite did not properly handle extraneous zero characters at the beginning of an IP address string. A remote attacker could possibly use this issue to bypass access controls that are based on IP addresses. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-47154)

It was discovered that Net::CIDR::Lite did not properly validate the IPv6 group count when handling uncompressed IPv6 addresses. A remote attacker could possibly use this issue to bypass access controls. (CVE-2026-40198)

It was discovered that Net::CIDR::Lite mishandled IPv4 mapped IPv6 addresses. A remote attacker could possibly use this issue to bypass access controls that are based on IP addresses. (CVE-2026-40199)

Record
USN-8406-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
perl-net-cidr-lite
Alpine:v3.21
 before 0.23-r0
0.23-r0
perl-net-cidr-lite
Alpine:v3.22
 before 0.23-r0
0.23-r0
perl-net-cidr-lite
Alpine:v3.23
 before 0.23-r0
0.23-r0
perl-net-cidr-lite
Alpine:v3.24
 before 0.23-r0
0.23-r0
perl-Net-CIDR-Lite
Azure Linux:3
 through 0.22-2 None known
libnet-cidr-lite-perl
Debian:12
 before 0.22-3~deb12u1, plus listed versions
0.22-2
0.22-3~deb12u1
libnet-cidr-lite-perl
Debian:13
 before 0.22-3~deb13u1, plus listed versions
0.22-20.22-3~deb12u10.22-3~deb12u2
0.22-3~deb13u1
libnet-cidr-lite-perl
Debian:14
 before 0.22-3, plus listed versions
0.22-20.22-3~deb12u10.22-3~deb12u20.22-3~deb13u10.22-3~deb13u2
0.22-3
perl-Net-CIDR-Lite
Mageia:9
From an advisory covering 2 CVEs
 before 0.230.0-1.mga9
0.230.0-1.mga9
libnet-cidr-lite-perl
Ubuntu:Pro:16.04:LTS
 before 0.21-1ubuntu0.16.04.1~esm1, plus listed versions
0.21-1
0.21-1ubuntu0.16.04.1~esm1
Show 14 moreShow less
Affected packages
PackageAffectedFixed
libnet-cidr-lite-perl
Ubuntu:Pro:18.04:LTS
 before 0.21-1ubuntu0.18.04.1~esm1, plus listed versions
0.21-1
0.21-1ubuntu0.18.04.1~esm1
libnet-cidr-lite-perl
Ubuntu:Pro:20.04:LTS
 before 0.21-2ubuntu0.1+esm1, plus listed versions
0.21-20.21-2ubuntu0.1
0.21-2ubuntu0.1+esm1
libnet-cidr-lite-perl
Ubuntu:22.04:LTS
 before 0.22-1ubuntu0.1, plus listed versions
0.22-1
0.22-1ubuntu0.1
libnet-cidr-lite-perl
Ubuntu:24.04:LTS
 before 0.22-2ubuntu0.24.04.1, plus listed versions
0.22-2
0.22-2ubuntu0.24.04.1
libnet-cidr-lite-perl
Ubuntu:25.10
 before 0.22-2ubuntu0.25.10.1, plus listed versions
0.22-2
0.22-2ubuntu0.25.10.1
libnet-cidr-lite-perl
Ubuntu:26.04:LTS
 before 0.22-2ubuntu0.26.04.1, plus listed versions
0.22-2
0.22-2ubuntu0.26.04.1
libnet-cidr-lite-perl
Ubuntu:Pro:16.04:LTS
From an advisory covering 3 CVEs
 before 0.21-1ubuntu0.16.04.1~esm1, plus listed versions
0.21-1
0.21-1ubuntu0.16.04.1~esm1
libnet-cidr-lite-perl
Ubuntu:Pro:18.04:LTS
From an advisory covering 3 CVEs
 before 0.21-1ubuntu0.18.04.1~esm1, plus listed versions
0.21-1
0.21-1ubuntu0.18.04.1~esm1
libnet-cidr-lite-perl
Ubuntu:Pro:20.04:LTS
From an advisory covering 3 CVEs
 before 0.21-2ubuntu0.1+esm1, plus listed versions
0.21-20.21-2ubuntu0.1
0.21-2ubuntu0.1+esm1
libnet-cidr-lite-perl
Ubuntu:22.04:LTS
From an advisory covering 3 CVEs
 before 0.22-1ubuntu0.1, plus listed versions
0.22-1
0.22-1ubuntu0.1
libnet-cidr-lite-perl
Ubuntu:24.04:LTS
From an advisory covering 3 CVEs
 before 0.22-2ubuntu0.24.04.1, plus listed versions
0.22-2
0.22-2ubuntu0.24.04.1
libnet-cidr-lite-perl
Ubuntu:25.10
From an advisory covering 3 CVEs
 before 0.22-2ubuntu0.25.10.1, plus listed versions
0.22-2
0.22-2ubuntu0.25.10.1
libnet-cidr-lite-perl
Ubuntu:26.04:LTS
From an advisory covering 3 CVEs
 before 0.22-2ubuntu0.26.04.1, plus listed versions
0.22-2
0.22-2ubuntu0.26.04.1
perl-Net-CIDR-Lite
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 0.240.0-1.1
0.240.0-1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40199 is a medium vulnerability (CVSS 6.5) in Stigtsp Net::cidr::lite, published April 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in perl-net-cidr-lite 0.23-r0.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open