CVE-2026-45190

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass

View on CVE.org
Published May 10, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.

Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.

Example:

my $cidr = Net::CIDR::Lite->new();
$cidr->add("::1\n/128");
$cidr->find("::1a"); # incorrectly returns true

See also CVE-2026-45191.

Analysis

AI-generated

Technical impact

The library fails to properly validate IP addresses and CIDR masks, permitting input strings such as a trailing newline or non‑ASCII characters to be accepted and then re‑encoded by the parser to a misleading network address. When the library’s find() or bin_find() functions are invoked, they may incorrectly report a match, allowing an attacker to bypass IP‑based access control lists. This flaw is an input‑validation weakness, identified as CWE‑1287 and CWE‑1289.

Affected Systems

The flaw affects the Net::CIDR::Lite Perl module provided by STIGTSP, specifically all versions prior to 0.24.

Risk and Exploitability

Because the vulnerability permits control over the network address used in ACL checks, an attacker with the ability to supply arbitrary strings to the module could gain unauthorized access to protected resources. The precise exploitability depends on how the library is integrated into an application; if user input flows directly into the module, remote exploitation is possible, based on an inferred attack scenario. The CVSS score is 6.5, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog.

Remediation

Vendor Solution

Upgrade to version 0.24 or newer, or apply the patch provided.

OpenCVE Recommended Actions

  • Upgrade the Net::CIDR::Lite module to version 0.24 or newer, which includes the input‑validation fix.
  • Apply the patch available at https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381ea8d13e692.patch if upgrading is not immediately possible.
  • Add input sanitisation to reject IP strings with trailing newlines, non‑ASCII digits, or otherwise malformed addresses before passing them to the module as a short‑term safeguard.

Generated by OpenCVE AI on May 19, 2026 at 01:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Ubuntu USN Ubuntu USN USN-8453-1 Net::CIDR::Lite vulnerabilities
History
Type Values Removed Values Added
Weaknesses CWE-1287
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Stigtsp
Stigtsp net::cidr::lite
Vendors & Products Stigtsp
Stigtsp net::cidr::lite
Type Values Removed Values Added
Description Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass. Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result. Example: my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true See also CVE-2026-45191.
Title Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass
Weaknesses CWE-1289
References
Weaknesses
  • CWE-1287

    Improper Validation of Specified Type of Input

  • CWE-1289

    Improper Validation of Unsafe Equivalence in Input

Sources

Status
PUBLISHED
Assigner
CPANSec
Published
Updated
May 12, 2026, 2:31 PM
Reserved
May 10, 2026, 4:36 PM

View source JSON

Updated
May 12, 2026, 2:30 PM

JSON

Status
Deferred
Published
May 10, 2026, 9:16 PM
Modified
Jul 24, 2026, 1:10 PM

View source JSON

Severity
Moderate
Public date
May 10, 2026, 8:15 PM

View source Bugzilla JSON

Updated
May 19, 2026, 1:30 AM

JSON