CVE-2026-49942
Net::CIDR::Set Perl Module Network Mask Validation Bypass
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: CPANSec
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1289 | The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided context and resources do not contain information about how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability affects Net::CIDR::Set versions through 0.20 for Perl, where the software did not properly validate network masks.
Specifically, the mask portion of a network mask could include Unicode digits such as the Arabic-Indic One (U+0661) or non-digit characters, which were ignored during validation. This flaw allowed network masks to accept larger networks than intended.
Additionally, leading zeros in the mask were accepted but treated as decimal numbers instead of octal, causing confusion about which networks were considered valid.
How can this vulnerability impact me? :
Because the network mask validation is flawed, attackers could craft network masks that bypass intended restrictions by using Unicode digits or improperly formatted masks.
This could lead to acceptance of larger or unintended network ranges, potentially allowing unauthorized access or bypassing network access controls.
Such bypasses might compromise the integrity of network-based security policies or filters that rely on accurate CIDR mask validation.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Net::CIDR::Set to a version that properly validates network masks and does not accept invalid or confusing mask formats such as those containing Unicode digits or leading zeros treated incorrectly.
Since the vulnerability affects versions through 0.20, upgrading to a later patched version or applying available patches is recommended.