CVE-2026-45191CWE-1289

Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass

Medium · published May 10, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.

Mask forms like "/00" and "/01" pass validation and parse to the same prefix as their unpadded value.

See also CVE-2026-45190.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00484 · 40.7th percentile
Weakness
CWE-1289 · Improper Validation of Unsafe Equivalence in Input
Published
2026-05-10T20:15Z
EPSS history
Timeline
  • 10 MAY 20:15Z
    Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass
    cvelistv5