CVE-2025-40910CWE-1287

CVE-2025-40910

Medium · published June 27, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
25.6
In the wild
Unconfirmed
What it is

Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses.

Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00335 · 25.6th percentile
Weakness
CWE-1287 · Improper Validation of Specified Type of Input
Published
2025-06-27T17:15Z
References (5)
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://metacpan.org/release/RRWO/Net-IP-LPM-1.11/changes · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://metacpan.org/release/TPODER/Net-IP-LPM-1.10/diff/TPODER/Net-IP-LPM-1.09/lib/Net/IP/LPM.pm · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://rt.cpan.org/Ticket/Display.html?id=179855 · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://security.metacpan.org/patches/N/Net-IP-LPM/1.10/CVE-2025-40910-r1.patch · 9b29abf9-4ab0-4765-b253-1875cd9b441e
EPSS history
Timeline
  • 27 JUN 12:19Z
    Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses
    cvelistv5