Net::CIDR::Lite fails to validate the number of groups in an uncompressed IPv6 address. When strings such as "1:2:3" are parsed, the library produces packed values that are shorter than the required 17 bytes. These malformed values are later used for mask and comparison logic. Because Perl string comparison on differing lengths yields incorrect results, the module may mistakenly report that an address is inside or outside a CIDR range, allowing unauthorized traffic to pass ACL checks.

The vulnerability exists in the Net::CIDR::Lite Perl module provided by STIGTSP. All releases before version 0.23 are affected; version 0.23 and newer include the validation fix.

The CVSS score of 7.5 marks the issue as high severity, but the EPSS score below 1% indicates a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits. Attackers would need to supply crafted IPv6 addresses to a Perl application that uses this module for ACL enforcement, so the attack vector is largely application‑level input injection.