{"id":"CVE-2026-45191","aliases":["ALPINE-CVE-2026-45191","AZL-86417","DEBIAN-CVE-2026-45191","EUVD-2026-28999","GHSA-fw62-67j2-4wmc","MGASA-2026-0136","SUSE-SU-2026:2113-1","UBUNTU-CVE-2026-45191","USN-8453-1","openSUSE-SU-2026:10780-1"],"status":"published","title":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.\n\nMask forms like \"/00\" and \"/01\" pass validation and parse to the same prefix as their unpadded value.\n\nSee also CVE-2026-45190.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.003,"percentile":0.22854,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1289"],"published":"2026-05-10T20:15:53Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"perl-net-cidr-lite","fixed_in":["0.24-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libnet-cidr-lite-perl","fixed_in":["0.22-3~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libnet-cidr-lite-perl","fixed_in":["0.22-3~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libnet-cidr-lite-perl","fixed_in":["0.24-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libnet-cidr-lite-perl","fixed_in":["0.21-1ubuntu0.16.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libnet-cidr-lite-perl","fixed_in":["0.21-1ubuntu0.18.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libnet-cidr-lite-perl","fixed_in":["0.21-2ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libnet-cidr-lite-perl","fixed_in":["0.22-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libnet-cidr-lite-perl","fixed_in":["0.22-2ubuntu0.24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libnet-cidr-lite-perl","fixed_in":["0.22-2ubuntu0.25.10.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libnet-cidr-lite-perl","fixed_in":["0.22-2ubuntu0.26.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-net-cidr-lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-Net-CIDR-Lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.22-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-3~deb12u2"}]}],"versions":["0.22-2","0.22-3~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-3~deb13u2"}]}],"versions":["0.22-2","0.22-3~deb12u1","0.22-3~deb12u2","0.22-3~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24-1"}]}],"versions":["0.22-2","0.22-3","0.22-3~deb12u1","0.22-3~deb12u2","0.22-3~deb13u1","0.22-3~deb13u2","0.23-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Net-CIDR-Lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.240.0-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1ubuntu0.16.04.1~esm2"}]}],"versions":["0.21-1","0.21-1ubuntu0.16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1ubuntu0.18.04.1~esm2"}]}],"versions":["0.21-1","0.21-1ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-2ubuntu0.1+esm2"}]}],"versions":["0.21-2","0.21-2ubuntu0.1","0.21-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-1ubuntu0.2"}]}],"versions":["0.22-1","0.22-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-2ubuntu0.24.04.2"}]}],"versions":["0.22-2","0.22-2ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-2ubuntu0.25.10.2"}]}],"versions":["0.22-2","0.22-2ubuntu0.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-2ubuntu0.26.04.2"}]}],"versions":["0.22-2","0.22-2ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1ubuntu0.16.04.1~esm2"}]}],"versions":["0.21-1","0.21-1ubuntu0.16.04.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1ubuntu0.18.04.1~esm2"}]}],"versions":["0.21-1","0.21-1ubuntu0.18.04.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-2ubuntu0.1+esm2"}]}],"versions":["0.21-2","0.21-2ubuntu0.1","0.21-2ubuntu0.1+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-1ubuntu0.2"}]}],"versions":["0.22-1","0.22-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-2ubuntu0.24.04.2"}]}],"versions":["0.22-2","0.22-2ubuntu0.24.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-2ubuntu0.25.10.2"}]}],"versions":["0.22-2","0.22-2ubuntu0.25.10.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libnet-cidr-lite-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22-2ubuntu0.26.04.2"}]}],"versions":["0.22-2","0.22-2ubuntu0.26.04.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Net-CIDR-Lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.240.0-1.1"}]}],"bundled":4}],"products":[{"vendor":"stigtsp","product":"net::cidr::lite"}],"references":[{"url":"https://github.com/stigtsp/Net-CIDR-Lite/commit/24e2c439ec405e5256024b9acefd4f7008c5ed0c.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes","tags":["release-notes","advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45190","tags":["related","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45191","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fw62-67j2-4wmc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-45191","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45191.json","tags":["advisory"]},{"url":"https://github.com/stigtsp/Net-CIDR-Lite","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-45191","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0136.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35506","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/10/6","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/10/7","tags":["web","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262113-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262088","tags":["report"]},{"url":"https://bugzilla.suse.com/1264709","tags":["report"]},{"url":"https://bugzilla.suse.com/1264710","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45191","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-45191","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45191","tags":["report"]},{"url":"https://github.com/stigtsp/Net-CIDR-Lite/commit/24e2c439ec405e5256024b9acefd4f7008c5ed0c","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/39920370/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8453-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-45190","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-45191","title":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.\n\nMask forms like \"/00\" and \"/01\" pass validation and parse to the same prefix as their unpadded value.\n\nSee also CVE-2026-45190.","status":"published","published":"2026-05-10T20:15:53.897Z","modified":"2026-05-11T16:37:48.124Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-1289"],"updated_at":"2026-11-02T13:46:55.086623Z"}],"euvd":[{"id":"EUVD-2026-28999","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.\n\nMask forms like \"/00\" and \"/01\" pass validation and parse to the same prefix as their unpadded value.\n\nSee also CVE-2026-45190.","status":"published","published":"2026-05-10T20:15:53Z","modified":"2026-05-11T16:37:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:05:10.736891Z"}],"ghsa":[{"id":"GHSA-fw62-67j2-4wmc","title":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero...","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.\n\nMask forms like \"/00\" and \"/01\" pass validation and parse to the same prefix as their unpadded value.\n\nSee also CVE-2026-45190.","status":"published","published":"2026-05-10T21:30:23Z","modified":"2026-05-11T18:32:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-1289"],"updated_at":"2026-11-02T15:07:59.393178Z"}],"nvd":[{"id":"CVE-2026-45191","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.\n\nMask forms like \"/00\" and \"/01\" pass validation and parse to the same prefix as their unpadded value.\n\nSee also CVE-2026-45190.","status":"published","published":"2026-05-10T21:16:29.38Z","modified":"2026-07-24T13:10:00.223Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-1289"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"ALPINE-CVE-2026-45191","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.\n\nMask forms like \"/00\" and \"/01\" pass validation and parse to the same prefix as their unpadded value.\n\nSee also CVE-2026-45190.","status":"published","published":"2026-05-10T21:16:29.38Z","modified":"2026-10-01T02:17:49.31109496Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"CVE-2026-45191","title":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.\n\nMask forms like \"/00\" and \"/01\" pass validation and parse to the same prefix as their unpadded value.\n\nSee also CVE-2026-45190.","status":"published","published":"2026-05-10T20:15:53.897Z","modified":"2026-10-28T02:30:33.029339375Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-1289"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"DEBIAN-CVE-2026-45191","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.  Mask forms like \"/00\" and \"/01\" pass validation and parse to the same prefix as their unpadded value.  See also CVE-2026-45190.","status":"published","published":"2026-05-10T21:16:29.38Z","modified":"2026-10-01T03:03:05.947366695Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"UBUNTU-CVE-2026-45191","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass. Mask forms like \"/00\" and \"/01\" pass validation and parse to the same prefix as their unpadded value. See also CVE-2026-45190.","status":"published","published":"2026-06-15T00:00:00Z","modified":"2026-06-24T11:01:43.16037541Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"AZL-86417","title":"CVE-2026-45191 affecting package perl-Net-CIDR-Lite 0.22-2","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.\n\nMask forms like \"/00\" and \"/01\" pass validation and parse to the same prefix as their unpadded value.\n\nSee also CVE-2026-45190.","status":"published","published":"2026-05-10T21:16:29Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"MGASA-2026-0136","title":"Updated perl-Net-CIDR-Lite packages fix security vulnerabilities","description":"Net::CIDR::Lite versions before 0.24 for Perl does not properly validate\nIP address and CIDR mask inputs, which may allow IP ACL bypass.\n(CVE-2026-45190)\nNet::CIDR::Lite versions before 0.24 for Perl does not properly consider\nextraneous zero characters in CIDR mask values, which may allow IP ACL\nbypass. (CVE-2026-45191)\n","status":"published","published":"2026-05-14T02:43:25Z","modified":"2026-05-14T02:45:13.411461Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10780-1","title":"perl-Net-CIDR-Lite-0.240.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Net-CIDR-Lite-0.240.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-14T00:00:00Z","modified":"2026-05-15T09:00:23.872855Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2026:2113-1","title":"Security update for perl-Net-CIDR-Lite","description":"This update for perl-Net-CIDR-Lite fixes the following issues\n\n- CVE-2026-45190: improper validation of trailing newlines or non-ASCII digits can lead to IP ACL bypass (bsc#1264710).\n- CVE-2026-45191: extraneous leading zeros in CIDR mask values can lead to IP ACL bypass (bsc#1264709).\n- CVE-2026-40198: missing validation for the IPv6 group count can lead to IP ACL bypass (bsc#1262088).\n- CVE-2026-40199: mishandled IPv4 mapped IPv6 addresses can lead to IP ACL bypass (bsc#1262088).\n","status":"published","published":"2026-05-29T15:24:46Z","modified":"2026-05-30T23:15:05.036497811Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"USN-8453-1","title":"libnet-cidr-lite-perl vulnerabilities","description":"It was discovered that Net::CIDR::Lite incorrectly validated IP address and\nCIDR mask inputs. An attacker could possibly use this issue to bypass IP\naccess control lists. (CVE-2026-45190)\n\nIt was discovered that Net::CIDR::Lite incorrectly handled extraneous zero\ncharacters in CIDR mask values. An attacker could possibly use this issue\nto bypass IP access control lists. (CVE-2026-45191)","status":"published","published":"2026-06-18T16:15:55Z","modified":"2026-06-18T22:14:13.099306947Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}