{"id":"CVE-2021-47154","aliases":["DEBIAN-CVE-2021-47154","DLA-3770-1","EUVD-2021-33802","GHSA-gpvh-42rv-p6wg","OESA-2024-1303","OESA-2024-1304","OESA-2024-1305","SUSE-SU-2024:1256-1","UBUNTU-CVE-2021-47154","USN-6712-1","USN-8406-1"],"status":"published","title":"The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero...","description":"The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00489,"percentile":0.42349,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-03-18T00:00:00Z","modified":"2026-10-23T18:05:23Z","fixes":[{"ecosystem":"Debian:12","package":"libnet-cidr-lite-perl","fixed_in":["0.22-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libnet-cidr-lite-perl","fixed_in":["0.22-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libnet-cidr-lite-perl","fixed_in":["0.22-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libnet-cidr-lite-perl","fixed_in":["0.21-2+debu10u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"perl-Net-CIDR-Lite","fixed_in":["0.21-24.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-Net-CIDR-Lite","fixed_in":["0.21-24.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"perl-Net-CIDR-Lite","fixed_in":["0.21-24.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"perl-Net-CIDR-Lite","fixed_in":["0.21-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"perl-Net-CIDR-Lite","fixed_in":["0.21-150100.6.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libnet-cidr-lite-perl","fixed_in":["0.21-1ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libnet-cidr-lite-perl","fixed_in":["0.21-1ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libnet-cidr-lite-perl","fixed_in":["0.21-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-2+debu10u1"}]}],"versions":["0.21-2"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"perl-Net-CIDR-Lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-24.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-Net-CIDR-Lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-24.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"perl-Net-CIDR-Lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-24.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"perl-Net-CIDR-Lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"perl-Net-CIDR-Lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-150100.6.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1ubuntu0.16.04.1~esm1"}]}],"versions":["0.21-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1ubuntu0.18.04.1~esm1"}]}],"versions":["0.21-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-2ubuntu0.1"}]}],"versions":["0.21-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-2ubuntu0.1"}]}],"versions":["0.21-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1ubuntu0.16.04.1~esm1"}]}],"versions":["0.21-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1ubuntu0.18.04.1~esm1"}]}],"versions":["0.21-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-2ubuntu0.1+esm1"}]}],"versions":["0.21-2","0.21-2ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-1ubuntu0.1"}]}],"versions":["0.22-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-2ubuntu0.24.04.1"}]}],"versions":["0.22-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-2ubuntu0.25.10.1"}]}],"versions":["0.22-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-2ubuntu0.26.04.1"}]}],"versions":["0.22-2"],"bundled":3}],"references":[{"url":"https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/","tags":["x_transferred","article","report"]},{"url":"https://metacpan.org/pod/Net::CIDR::Lite","tags":["x_transferred","web"]},{"url":"https://github.com/stigtsp/Net-CIDR-Lite/commit/23b6ff0590dc279521863a502e890ef19a5a76fc","tags":["x_transferred","fix"]},{"url":"https://metacpan.org/dist/Net-CIDR-Lite/changes","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00023.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47154","tags":["advisory"]},{"url":"https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros"},{"url":"https://github.com/advisories/GHSA-gpvh-42rv-p6wg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-47154","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1303","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1304","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1305","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241256-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221564","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47154","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-47154","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6712-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-47154","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8406-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40199","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-47154","description":"The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2024-03-18T00:00:00Z","modified":"2024-11-15T21:46:52.681Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:55.905855Z"}],"euvd":[{"id":"EUVD-2021-33802","description":"The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2024-03-18T00:00:00Z","modified":"2024-11-15T21:46:52Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:57.661321Z"}],"ghsa":[{"id":"GHSA-gpvh-42rv-p6wg","title":"The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero...","description":"The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2024-03-18T06:30:51Z","modified":"2024-11-16T00:32:52Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T14:58:51.906051Z"}],"nvd":[{"id":"CVE-2021-47154","description":"The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2024-03-18T05:15:06.14Z","modified":"2026-06-17T04:16:40.813Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:08.163458Z"}],"osv":[{"id":"CVE-2021-47154","description":"The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2024-03-18T05:15:06.14Z","modified":"2026-10-20T10:55:11.621269108Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:22.470367Z"},{"id":"DEBIAN-CVE-2021-47154","description":"The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2024-03-18T05:15:06.14Z","modified":"2026-10-23T18:05:23.8740817Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:36.081807Z"},{"id":"OESA-2024-1303","title":"perl-Net-CIDR-Lite security update","description":"Faster alternative to Net::CIDR when merging a large number of CIDR address ranges. Works for IPv4 and IPv6 addresses.\r\n\r\nSecurity Fix(es):\r\n\r\nThe Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.(CVE-2021-47154)","status":"published","published":"2024-03-22T11:06:45Z","modified":"2026-08-18T01:18:19.125582077Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1304","title":"perl-Net-CIDR-Lite security update","description":"Faster alternative to Net::CIDR when merging a large number of CIDR address ranges. Works for IPv4 and IPv6 addresses.\r\n\r\nSecurity Fix(es):\r\n\r\nThe Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.(CVE-2021-47154)","status":"published","published":"2024-03-22T11:06:45Z","modified":"2026-08-18T01:18:19.415063719Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1305","title":"perl-Net-CIDR-Lite security update","description":"Faster alternative to Net::CIDR when merging a large number of CIDR address ranges. Works for IPv4 and IPv6 addresses.\r\n\r\nSecurity Fix(es):\r\n\r\nThe Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.(CVE-2021-47154)","status":"published","published":"2024-03-22T11:06:45Z","modified":"2026-08-18T01:18:19.313827416Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"UBUNTU-CVE-2021-47154","description":"The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.","status":"published","published":"2024-03-18T05:15:00Z","modified":"2026-06-08T23:14:22.261549947Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:30.277322Z"},{"id":"DLA-3770-1","title":"libnet-cidr-lite-perl - security update","status":"published","published":"2024-03-23T00:00:00Z","modified":"2026-03-09T01:18:10.0551Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"SUSE-SU-2024:1256-1","title":"Security update for perl-Net-CIDR-Lite","description":"This update for perl-Net-CIDR-Lite fixes the following issues:\n\n- CVE-2021-47154: Fixed leading zeroes in IPv4 octets may allow attackers to bypass certain access controls (bsc#1221564).\n","status":"published","published":"2024-04-12T10:52:16Z","modified":"2026-02-04T03:46:39.659175Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-6712-1","title":"libnet-cidr-lite-perl vulnerability","description":"It was discovered that Net::CIDR::Lite incorrectly handled extra zero\ncharacters at the beginning of IP address strings. A remote attacker could\npossibly use this issue to bypass access controls.\n","status":"published","published":"2024-03-25T11:56:34Z","modified":"2026-04-27T17:10:37.445291Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-8406-1","title":"libnet-cidr-lite-perl vulnerabilities","description":"Dave Rolsky discovered that Net::CIDR::Lite did not properly handle\nextraneous zero characters at the beginning of an IP address string. A\nremote attacker could possibly use this issue to bypass access controls\nthat are based on IP addresses. This issue only affected Ubuntu 16.04 LTS\nand Ubuntu 18.04 LTS. (CVE-2021-47154)\n\nIt was discovered that Net::CIDR::Lite did not properly validate the IPv6\ngroup count when handling uncompressed IPv6 addresses. A remote attacker\ncould possibly use this issue to bypass access controls. (CVE-2026-40198)\n\nIt was discovered that Net::CIDR::Lite mishandled IPv4 mapped IPv6\naddresses. A remote attacker could possibly use this issue to bypass access\ncontrols that are based on IP addresses. (CVE-2026-40199)","status":"published","published":"2026-06-08T16:06:45Z","modified":"2026-06-08T23:14:21.920330254Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}