Net::CIDR::Set versions up to 0.20 failed to validate IP addresses supplied to the add method. When the input did not resemble a netmask or network range, the library treated it as a single IP and recursively passed it back to itself via the _encode routine. This unbounded recursion can exhaust system resources and crash the process, resulting in a denial of service. The flaw does not provide a path to arbitrary code execution or data disclosure; it merely impacts availability.

The affected product is Net::CIDR::Set from the vendor RRWO. All releases through version 0.20 are impacted, including 0.20 and all earlier iterations that lack the validation safeguard.

The CVSS score of 7.5 indicates a high risk, and EPSS data are not available, so the threat assessment relies on the description. The vulnerability can be triggered by supplying a malformed IP to the add routine, a scenario that could arise from untrusted input in Perl applications that import this module. Though the attack surface requires the attacker to influence the invocation of add, it can lead to a noticeable denial of service. The issue is not listed in CISA's KEV catalog, indicating it has not been observed as a widely exploited vulnerability in the wild.