CVE-2026-49940
Net::CIDR::Set Perl Module Unicode IP Address Parsing Flaw
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: CPANSec
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1289 | The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
Because the vulnerability allows network masks to accept larger networks due to improper parsing of Unicode digits, it could lead to incorrect network configurations.
This might result in unintended network access or exposure, potentially allowing attackers or unauthorized users to access network resources that should be restricted.
Can you explain this vulnerability to me?
The vulnerability in Net::CIDR::Set versions through 0.20 for Perl involves the acceptance of non-ASCII IP addresses and netmasks.
Specifically, Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers.
This improper parsing could allow network masks to accept larger networks than intended.