CVE-2026-40198
IPv6 Input Validation Flaw in Net::CIDR::Lite Enables ACL Bypass
Publication date: 2026-04-10
Last updated on: 2026-04-21
Assigner: CPANSec
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| stigtsp | net | to 0.23 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1286 | The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in Net::CIDR::Lite versions before 0.23 for Perl, where the software does not properly validate the number of groups in an IPv6 address.
Specifically, the _pack_ipv6() function fails to check that uncompressed IPv6 addresses have exactly 8 hexadecimal groups. As a result, invalid inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce incorrectly sized packed values.
These incorrect packed values are then used internally for mask and comparison operations. The find() and bin_find() functions rely on Perl string comparisons on these packed values, but comparing strings of different lengths leads to incorrect results.
This can cause the find() function to mistakenly report an IP address as being inside or outside a specified range, effectively allowing IP Access Control List (ACL) bypass.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to bypass IP-based access controls by exploiting the incorrect validation of IPv6 addresses.
Because the software may incorrectly determine whether an IP address is within a permitted range, unauthorized users could gain access to restricted resources or services.
This undermines network security measures that rely on accurate IP address filtering, potentially leading to unauthorized access, data exposure, or other security breaches.