Net::CIDR::Lite versions prior to 0.23 mishandle IPv4-mapped IPv6 addresses by appending a sentinel byte, producing an 18-byte representation instead of the expected 17 bytes. This misalignment leads to incorrect mask calculations and the find functions may return false positives or negatives when evaluating IP membership. The effect is that an application using this library for IP access control could incorrectly allow or deny traffic, effectively bypassing the ACL mechanism.

The flaw affects all releases of the STIGTSP Net::CIDR::Lite Perl module before version 0.23. Any system or application that imports this module to interpret IPv4-mapped IPv6 addresses or perform CIDR calculations could be impacted.

The CVSS score is 6.5, indicating moderate severity, while the EPSS score is reported as less than 1% and the vulnerability is not listed in the CISA KEV catalog. The CVE description does not mention existing exploits; the vulnerability can be exploited by supplying a crafted IPv4-mapped IPv6 address to an application that relies on Net::CIDR::Lite for ACL decisions, but availability of a public exploit is not documented.