CVE-2026-86287
Received Received - Intake

Malformed Prefix Lengths in Net::IP::LPM

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: CPANSec

Description
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86287
EUVD
EUVD-2026-72526

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1287 The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Net::IP::LPM Perl module before version 1.12. It involves improper validation of IP prefix lengths where non-numeric or non-ASCII values are treated as zero and large integers are truncated. This causes lookup tables to be poisoned, leading to incorrect results where allow-lists permit all addresses and deny-lists block all addresses.

Detection Guidance

To detect this vulnerability, check if your system uses Net::IP::LPM versions before 1.12 for Perl. Run: perl -MNet::IP::LPM -e 'print $Net::IP::LPM::VERSION' and verify if the version is less than 1.12. Additionally, inspect Perl scripts using this module for improper prefix length handling in IP lookups.

Impact Analysis

If you use the affected Net::IP::LPM module, this flaw could allow unauthorized access by bypassing IP-based security controls. Allow-lists may permit malicious traffic while deny-lists may block legitimate traffic, disrupting network security and operations.

Mitigation Strategies

Immediately update Net::IP::LPM to version 1.12 or later. If updating is not possible, review and validate all IP prefix lengths in your code to ensure they are numeric and within valid ranges. Remove any allow-list or deny-list logic that could be bypassed by malformed prefixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86287. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart