{"id":"CVE-2021-4456","aliases":["DEBIAN-CVE-2021-4456","EUVD-2021-34770","GHSA-6xjh-63ff-92mc","UBUNTU-CVE-2021-4456","USN-8110-1","openSUSE-SU-2026:10756-1","openSUSE-SU-2026:20773-1"],"status":"published","title":"Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact","description":"Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.\n\nThe functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.\n\nThe documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00374,"percentile":0.31722,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-704"],"published":"2026-02-27T00:16:36Z","modified":"2026-10-23T18:05:23Z","fixes":[{"ecosystem":"Debian:13","package":"libnet-cidr-perl","fixed_in":["0.25-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libnet-cidr-perl","fixed_in":["0.25-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libnet-cidr-perl","fixed_in":["0.17-1ubuntu0.14.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libnet-cidr-perl","fixed_in":["0.17-1ubuntu0.16.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libnet-cidr-perl","fixed_in":["0.18-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libnet-cidr-perl","fixed_in":["0.20-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libnet-cidr-perl","fixed_in":["0.21-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libnet-cidr-perl","fixed_in":["0.21-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-Net-CIDR","fixed_in":["0.270.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21-2","0.23-1","0.25-1","0.27-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17-1ubuntu0.14.04.1~esm2"}]}],"versions":["0.17-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17-1ubuntu0.16.04.1~esm2"}]}],"versions":["0.17-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18-1ubuntu0.1~esm2"}]}],"versions":["0.18-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20-1ubuntu0.1~esm2"}]}],"versions":["0.20-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1ubuntu0.2"}]}],"versions":["0.20-1","0.21-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-2ubuntu0.2"}]}],"versions":["0.21-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17-1ubuntu0.14.04.1~esm2"}]}],"versions":["0.17-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17-1ubuntu0.16.04.1~esm2"}]}],"versions":["0.17-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18-1ubuntu0.1~esm2"}]}],"versions":["0.18-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20-1ubuntu0.1~esm2"}]}],"versions":["0.20-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1ubuntu0.2"}]}],"versions":["0.20-1","0.21-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnet-cidr-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-2ubuntu0.2"}]}],"versions":["0.21-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Net-CIDR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.270.0-2.1"}]}]}],"products":[{"vendor":"mrsam","product":"net::cidr"},{"vendor":"mrsam","product":"net\\"}],"references":[{"url":"https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/","tags":["related","Third Party Advisory","advisory","report"]},{"url":"https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10","tags":["patch","Patch","fix","report"]},{"url":"https://metacpan.org/dist/Net-CIDR/changes","tags":["release-notes","Release Notes","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4456"},{"url":"https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros"},{"url":"https://github.com/advisories/GHSA-6xjh-63ff-92mc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-4456","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-4456","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4456","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/37425715/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8110-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4456","tags":["web"]},{"url":"https://bugzilla.suse.com/1259024","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-4456","title":"Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact","description":"Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.\n\nThe functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.\n\nThe documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.","status":"published","published":"2026-02-27T00:16:36.383Z","modified":"2026-02-27T16:53:23.671Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T14:33:07.697752Z"}],"euvd":[{"id":"EUVD-2021-34770","description":"Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.\n\nThe functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.\n\nThe documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.","status":"published","published":"2026-02-27T00:16:36Z","modified":"2026-02-27T16:53:23Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:13.609806Z"}],"ghsa":[{"id":"GHSA-6xjh-63ff-92mc","title":"Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may...","description":"Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.\n\nThe functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.\n\nThe documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.","status":"published","published":"2026-02-27T03:30:26Z","modified":"2026-02-27T18:31:05Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T15:06:24.663603Z"}],"nvd":[{"id":"CVE-2021-4456","description":"Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.\n\nThe functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.\n\nThe documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.","status":"published","published":"2026-02-27T01:16:13.553Z","modified":"2026-06-17T04:19:47.703Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T14:07:09.005706Z"}],"osv":[{"id":"CVE-2021-4456","description":"Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.\n\nThe functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.\n\nThe documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.","status":"published","published":"2026-02-27T01:16:13.553Z","modified":"2026-10-20T10:55:06.683689628Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"DEBIAN-CVE-2021-4456","description":"Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.  The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.  The documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.","status":"published","published":"2026-02-27T01:16:13.553Z","modified":"2026-10-23T18:05:23.375902686Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"UBUNTU-CVE-2021-4456","description":"Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses. The documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.","status":"published","published":"2026-02-27T01:16:00Z","modified":"2026-03-20T06:36:38.330697Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"openSUSE-SU-2026:10756-1","title":"perl-Net-CIDR-0.270.0-2.1 on GA media","description":"These are all security issues fixed in the perl-Net-CIDR-0.270.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-12T00:00:00Z","modified":"2026-05-13T07:45:17.989581Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20773-1","title":"Security update for perl-Net-CIDR","description":"This update for perl-Net-CIDR fixes the following issues:\n\nChanges in perl-Net-CIDR:\n\n- updated to 0.270.0 (0.27)\n  0.27\tSam Varshavchik\n\tcidrvalidate() bug fix.\n\n- updated to 0.260.0 (0.26)\n  0.26    Sam Varshavchik\n\tcidrvalidate() should accept IPv6 addresses with one uncompressed 0.\n\n- updated to 0.250.0 (0.25)\n  0.25    Sam Varshavchik\n\tFix warning with Perl 5.40\n  0.24.1\n\tNo changes, re-pushed due to a release problem.\n  0.24\n  2025-03-09   brian d foy\n\t* Strip leading zeros from octets from addr2cidr\n    bsc#1259024 CVE-2021-4456\n\n- updated to 0.230.0 (0.23)\n  0.23\n  2025-03-09   brian d foy\n\t* Allow unabbreviated IPv6 addresses.\n  0.22\n  2025-03-09  Sam Varshavchik\n\t* Improve several error messages.\n  2025-03-09   brian d foy\n\t* Allow unabbreviated IPv6 addresses.\n","status":"published","published":"2026-05-19T16:18:04Z","modified":"2026-05-22T18:23:49.874612936Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"USN-8110-1","title":"libnet-cidr-perl vulnerability","description":"Dave Rolsky discovered that Net-CIDR did not properly sanitize IP\naddresses. An attacker could possibly use this to bypass IP-based\nrestrictions.","status":"published","published":"2026-03-18T19:40:53Z","modified":"2026-06-25T13:32:31.926301384Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}