CVE-2026-49942

Published: Jun 4, 2026Modified: Jun 17, 2026

7.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks. Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable.

Affected (1)

Products: Rrwo: Net\

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Rrwo Net\	Before 0.21

Related CWEs

Improper Validation of Unsafe Equivalence in Input

The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

References (3)

https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changes

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2025-40911

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Third Party AdvisoryUS Government Resource

https://nvd.nist.gov/vuln/detail/CVE-2026-45191

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.