CVE-2026-19566

Deferred Deferred - Pending Action

Memory Exhaustion in Net::CIDR::Set Perl Module

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: CPANSec

Description

Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The _encode method accepts any prefix length matching `(0|[1-9][0-9]*)` and passes it to _width2bits(), which builds the mask as `'1' x ($width + 8)`, one character per bit. The _inc() method then unpacks the packed mask into a Perl array of one scalar per byte, so the prefix length alone sets the allocation size: `::/100000000` builds a 100 MB string and a 12.5 million element array. The value being tested is parsed, not just the configured ranges: contains() builds a set from its argument, and _guess_coder() tries the IPv4 coder and then the IPv6 coder, so an IPv4-only set expands an oversized IPv6 prefix length before the mixed address width check rejects it. Any caller that passes untrusted input to contains() or add() can exhaust process memory. A prefix length above 128 is also stored as a range that does not match the requested block: 2001:db8::/129 stringifies back unchanged, contains() of its own base address returns false, and removing it from a set drops the base address while the set still prints as covering it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-12

EPSS Evaluated

2026-09-01

NVD

CVE-2026-19566

EUVD

EUVD-2026-57150

Affected Vendors & Products

Vendor	Product	Version / Range
robrwo	perl-net-cidr-set	to 0.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Perl module Net::CIDR::Set before version 0.23. It allows attackers to cause memory exhaustion by providing malformed IPv6 prefix lengths greater than 128. The module allocates memory based on the prefix length value, so inputs like ::/100000000 can consume excessive memory, leading to denial-of-service or crashes.

Detection Guidance

Check if your system uses Net::CIDR::Set versions before 0.23. Run: perl -MNet::CIDR::Set -e 'print $Net::CIDR::Set::VERSION' to verify the installed version. If the output is less than 0.23, the system is vulnerable.

Impact Analysis

If you use Net::CIDR::Set in your application and pass untrusted input to functions like contains() or add(), an attacker could exploit this to exhaust system memory. This may cause your application to crash, become unresponsive, or be terminated by the operating system.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions through memory exhaustion, which could disrupt system availability. While it does not directly violate GDPR or HIPAA, it may impact compliance by failing to ensure availability of critical systems, a requirement under both regulations for data processing and security.

Mitigation Strategies

Upgrade Net::CIDR::Set to version 0.23 or later. Use: cpan Net::CIDR::Set or cpanm Net::CIDR::Set to install the patched version. Review applications using the module for any unusual memory usage patterns.

Hi! I’m here to help you understand CVE-2026-19566. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70