CVE-2026-45191

Published: May 10, 2026Modified: Jun 17, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass. Mask forms like "/00" and "/01" pass validation and parse to the same prefix as their unpadded value. See also CVE-2026-45190.

Related CWEs

CWE-1289

Improper Validation of Unsafe Equivalence in Input

The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

References (3)

https://github.com/stigtsp/Net-CIDR-Lite/commit/24e2c439ec405e5256024b9acefd4f7008c5ed0c.patch

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://www.cve.org/CVERecord?id=CVE-2026-45190

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Timeline

No history available yet.