CVE-2026-45191

EUVD-2026-28999
Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.

Mask forms like "/00" and "/01" pass validation and parse to the same prefix as their unpadded value.

See also CVE-2026-45190.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 22.23%
Debian logo
Debian Releases
Debian Product
Codename
libnet-cidr-lite-perl
bookworm
0.22-3~deb12u2
fixed
bullseye
postponed
forky
0.24-1
fixed
sid
0.24-1
fixed
trixie
0.22-3~deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libnet-cidr-lite-perl
bionic
Fixed 0.21-1ubuntu0.18.04.1~esm2
released
focal
Fixed 0.21-2ubuntu0.1+esm2
released
jammy
Fixed 0.22-1ubuntu0.2
released
noble
Fixed 0.22-2ubuntu0.24.04.2
released
questing
Fixed 0.22-2ubuntu0.25.10.2
released
resolute
Fixed 0.22-2ubuntu0.26.04.2
released
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
perl-Net-CIDR-Lite
Amazon Linux 2023
0:0.22-8.amzn2023.0.2
fixed
Common Weakness Enumeration
References
https://github.com/stigtsp/Net-CIDR-Lite/commit/24e2c439ec405e5256024b9acefd4f7008c5ed0c.patch
https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes
https://www.cve.org/CVERecord?id=CVE-2026-45190