Net::CIDR::Set versions through 0.20 for Perl accept non‑ASCII digits in IP addresses and netmasks, but treat them as malformed numbers. Because the module does not interpret the digits correctly, a subnet mask may be interpreted as a larger network than intended. This discrepancy can enable an attacker to create an entry that expands a restricted network to cover more addresses, potentially giving them access to resources or information that should be excluded.

The vulnerability affects RRWO’s Net::CIDR::Set module for Perl up to and including version 0.20. Any installation of this module within scripts, applications, or systems that rely on accurate CIDR calculations could be impacted. The vendor provides an official fix in version 0.21.

The exploitability of this flaw depends on the attacker’s ability to supply IP and mask values to a vulnerable instance of the module. If such input can be controlled, the flaw could be abused to widen access rights or bypass network‑level restrictions. No EPSS score is currently available, and the issue is not listed in the CISA KEV catalog, indicating that active exploitation is not known. The CVSS score of 6.5 indicates moderate severity.