The Net::CIDR::Set Perl module in versions prior to 0.23 accepts any integer as an IPv6 prefix length, even values far beyond the 128‑bit limit. During encoding, the library constructs a binary mask whose size is proportional to the supplied prefix length, resulting in a string of at least (prefix+8) bits. An attacker can therefore trigger gigantic memory allocation, exhausting system resources and causing a denial of service. In addition, prefixes greater than 128 are stored as ranges that do not match the intended network, leading to malformed set arithmetic in which containment checks fail or removal operations leave an inaccurate representation of the set.

All installations of the Net::CIDR::Set CPAN module (RRWO:Net::CIDR::Set) older than version 0.23 are affected. The 0.23 release and later provide the necessary fix.

The most likely attack vector is when an application that uses Net::CIDR::Set receives untrusted IP range data and passes it directly to contains() or add(). The underlying library then allocates an enormous amount of memory, potentially crashing the process. The CVSS score of 7.5 indicates a high severity; the EPSS score of < 1% suggests a low current exploitation probability, but the presence of a memory exhaustion flaw and lack of input validation still make it a high‑risk vulnerability. The CVE is not listed in KEV, and the associated CWE identifiers (CWE‑1284 and CWE‑789) indicate a significant impact on confidentiality, integrity, and availability.