Net::IP::LPM versions prior to 1.12 incorrectly accept malformed prefix lengths, treating non‑numeric or excessively large values as zero and silently truncating integers over 31 bits. The result is that every lookup succeeds for any IP address, turning an allow list into a universal allow and a deny list into a universal deny. This falsifies the intended access controls, enabling traffic that should be blocked or blocking traffic that should be permitted.

The vulnerability affects the Perl Net::IP::LPM library in all releases before version 1.12. Any system that includes this module and uses it to parse IP prefixes for network ACLs is exposed.

Based on the description, it is inferred that the attacker must be able to supply or influence the prefix strings processed by the library, which is typically possible in local or application contexts that load the module. A successful exploit can bypass authorization checks or cause a denial of service by making the deny‑list reject all traffic. The EPSS score of < 1% and the CVSS score of 7.5 indicate a low probability of exploitation but a high severity impact, and the vulnerability is not listed in the CISA KEV catalog, so the documented likelihood is unknown, but the potential impact on network control is significant. Prompt remediation is advised due to the broad effect on access policies.