Every CVE Search/ Get API key

CVE-2026-45190

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass

6.5 MediumFix available

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.

Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.

Example:

my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true

See also CVE-2026-45191.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.31%Up 0.3 points since May 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.

Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.

Example:

my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true

See also CVE-2026-45191.

Record
CVE-2026-45190
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-1289
Updated
2026-11-02
EUVDEUVD-2026-28998 6.5

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.

Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.

Example:

my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true

See also CVE-2026-45191.

Record
EUVD-2026-28998
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-5vf8-328m-mxj5 6.5

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask...

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.

Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.

Example:

my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true

See also CVE-2026-45191.

Record
GHSA-5vf8-328m-mxj5
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-1289
Updated
2026-11-02
NVD 6.5

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.

Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.

Example:

my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true

See also CVE-2026-45191.

Record
CVE-2026-45190
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-1289
Updated
2026-11-02
OSVALPINE-CVE-2026-45190 6.5

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.

Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.

Example:

my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true

See also CVE-2026-45191.

Record
ALPINE-CVE-2026-45190
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSV 6.5

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.

Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.

Example:

my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true

See also CVE-2026-45191.

Record
CVE-2026-45190
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-1289
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2026-45190 6.5

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass. Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result. Example: my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true See also CVE-2026-45191.

Record
DEBIAN-CVE-2026-45190
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-45190 6.5

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass. Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result. Example: my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true See also CVE-2026-45191.

Record
UBUNTU-CVE-2026-45190
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVAZL-86414 No score

CVE-2026-45190 affecting package perl-Net-CIDR-Lite 0.22-2

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.

Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.

Example:

my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true

See also CVE-2026-45191.

Record
AZL-86414
Updated
2026-11-05
OSVMGASA-2026-0136 No score

Updated perl-Net-CIDR-Lite packages fix security vulnerabilities

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass. (CVE-2026-45190) Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass. (CVE-2026-45191)

Record
MGASA-2026-0136
Updated
2026-11-02
OSVopenSUSE-SU-2026:10780-1 No score

perl-Net-CIDR-Lite-0.240.0-1.1 on GA media

These are all security issues fixed in the perl-Net-CIDR-Lite-0.240.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10780-1
Updated
2026-11-02
OSVSUSE-SU-2026:2113-1 No score

Security update for perl-Net-CIDR-Lite

This update for perl-Net-CIDR-Lite fixes the following issues

  • CVE-2026-45190: improper validation of trailing newlines or non-ASCII digits can lead to IP ACL bypass (bsc#1264710).
  • CVE-2026-45191: extraneous leading zeros in CIDR mask values can lead to IP ACL bypass (bsc#1264709).
  • CVE-2026-40198: missing validation for the IPv6 group count can lead to IP ACL bypass (bsc#1262088).
  • CVE-2026-40199: mishandled IPv4 mapped IPv6 addresses can lead to IP ACL bypass (bsc#1262088).
Record
SUSE-SU-2026:2113-1
Updated
2026-11-02
OSVUSN-8453-1 No score

libnet-cidr-lite-perl vulnerabilities

It was discovered that Net::CIDR::Lite incorrectly validated IP address and CIDR mask inputs. An attacker could possibly use this issue to bypass IP access control lists. (CVE-2026-45190)

It was discovered that Net::CIDR::Lite incorrectly handled extraneous zero characters in CIDR mask values. An attacker could possibly use this issue to bypass IP access control lists. (CVE-2026-45191)

Record
USN-8453-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
perl-net-cidr-lite
Alpine:v3.24
 before 0.24-r0
0.24-r0
perl-Net-CIDR-Lite
Azure Linux:3
 through 0.22-2 None known
libnet-cidr-lite-perl
Debian:12
 before 0.22-3~deb12u2, plus listed versions
0.22-20.22-3~deb12u1
0.22-3~deb12u2
libnet-cidr-lite-perl
Debian:13
 before 0.22-3~deb13u2, plus listed versions
0.22-20.22-3~deb12u10.22-3~deb12u20.22-3~deb13u1
0.22-3~deb13u2
libnet-cidr-lite-perl
Debian:14
 before 0.24-1, plus listed versions
0.22-20.22-30.22-3~deb12u10.22-3~deb12u20.22-3~deb13u10.22-3~deb13u20.23-1
0.24-1
perl-Net-CIDR-Lite
Mageia:9
From an advisory covering 2 CVEs
 before 0.240.0-1.mga9
0.240.0-1.mga9
libnet-cidr-lite-perl
Ubuntu:Pro:16.04:LTS
 before 0.21-1ubuntu0.16.04.1~esm2, plus listed versions
0.21-10.21-1ubuntu0.16.04.1~esm1
0.21-1ubuntu0.16.04.1~esm2
libnet-cidr-lite-perl
Ubuntu:Pro:18.04:LTS
 before 0.21-1ubuntu0.18.04.1~esm2, plus listed versions
0.21-10.21-1ubuntu0.18.04.1~esm1
0.21-1ubuntu0.18.04.1~esm2
libnet-cidr-lite-perl
Ubuntu:Pro:20.04:LTS
 before 0.21-2ubuntu0.1+esm2, plus listed versions
0.21-20.21-2ubuntu0.10.21-2ubuntu0.1+esm1
0.21-2ubuntu0.1+esm2
libnet-cidr-lite-perl
Ubuntu:22.04:LTS
 before 0.22-1ubuntu0.2, plus listed versions
0.22-10.22-1ubuntu0.1
0.22-1ubuntu0.2
Show 11 moreShow less
Affected packages
PackageAffectedFixed
libnet-cidr-lite-perl
Ubuntu:24.04:LTS
 before 0.22-2ubuntu0.24.04.2, plus listed versions
0.22-20.22-2ubuntu0.24.04.1
0.22-2ubuntu0.24.04.2
libnet-cidr-lite-perl
Ubuntu:25.10
 before 0.22-2ubuntu0.25.10.2, plus listed versions
0.22-20.22-2ubuntu0.25.10.1
0.22-2ubuntu0.25.10.2
libnet-cidr-lite-perl
Ubuntu:26.04:LTS
 before 0.22-2ubuntu0.26.04.2, plus listed versions
0.22-20.22-2ubuntu0.26.04.1
0.22-2ubuntu0.26.04.2
libnet-cidr-lite-perl
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 0.21-1ubuntu0.16.04.1~esm2, plus listed versions
0.21-10.21-1ubuntu0.16.04.1~esm1
0.21-1ubuntu0.16.04.1~esm2
libnet-cidr-lite-perl
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
 before 0.21-1ubuntu0.18.04.1~esm2, plus listed versions
0.21-10.21-1ubuntu0.18.04.1~esm1
0.21-1ubuntu0.18.04.1~esm2
libnet-cidr-lite-perl
Ubuntu:Pro:20.04:LTS
From an advisory covering 2 CVEs
 before 0.21-2ubuntu0.1+esm2, plus listed versions
0.21-20.21-2ubuntu0.10.21-2ubuntu0.1+esm1
0.21-2ubuntu0.1+esm2
libnet-cidr-lite-perl
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 0.22-1ubuntu0.2, plus listed versions
0.22-10.22-1ubuntu0.1
0.22-1ubuntu0.2
libnet-cidr-lite-perl
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 0.22-2ubuntu0.24.04.2, plus listed versions
0.22-20.22-2ubuntu0.24.04.1
0.22-2ubuntu0.24.04.2
libnet-cidr-lite-perl
Ubuntu:25.10
From an advisory covering 2 CVEs
 before 0.22-2ubuntu0.25.10.2, plus listed versions
0.22-20.22-2ubuntu0.25.10.1
0.22-2ubuntu0.25.10.2
libnet-cidr-lite-perl
Ubuntu:26.04:LTS
From an advisory covering 2 CVEs
 before 0.22-2ubuntu0.26.04.2, plus listed versions
0.22-20.22-2ubuntu0.26.04.1
0.22-2ubuntu0.26.04.2
perl-Net-CIDR-Lite
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 0.240.0-1.1
0.240.0-1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-45190 is a medium vulnerability (CVSS 6.5) in Stigtsp Net::cidr::lite, published May 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in perl-net-cidr-lite 0.24-r0.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open