[<prev] [next>] [day] [month] [year] [list]
Message-Id: <13E246DC-BA21-4EDB-98EE-306E89489A0C@stig.io>
Date: Sun, 10 May 2026 22:25:36 +0200
From: Stig Palmquist <stig@...g.io>
To: cve-announce@...urity.metacpan.org,
oss-security@...ts.openwall.com
Subject: CVE-2026-45191: Net::CIDR::Lite versions before 0.24 for Perl does
not properly consider extraneous zero characters in CIDR mask values, which
may allow IP ACL bypass
========================================================================
CVE-2026-45191 CPAN Security Group
========================================================================
CVE ID: CVE-2026-45191
Distribution: Net-CIDR-Lite
Versions: before 0.24
MetaCPAN: https://metacpan.org/dist/Net-CIDR-Lite
VCS Repo: https://github.com/stigtsp/Net-CIDR-Lite
Net::CIDR::Lite versions before 0.24 for Perl does not properly
consider extraneous zero characters in CIDR mask values, which may
allow IP ACL bypass
Description
-----------
Net::CIDR::Lite versions before 0.24 for Perl does not properly
consider extraneous zero characters in CIDR mask values, which may
allow IP ACL bypass.
Mask forms like "/00" and "/01" pass validation and parse to the same
prefix as their unpadded value.
See also CVE-2026-45190.
Problem types
-------------
- CWE-1289 Improper Validation of Unsafe Equivalence in Input
Solutions
---------
Upgrade to version 0.24 or newer, or apply the patch provided.
References
----------
https://github.com/stigtsp/Net-CIDR-Lite/commit/24e2c439ec405e5256024b9acefd4f7008c5ed0c.patch
https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes
https://www.cve.org/CVERecord?id=CVE-2026-45190
Timeline
--------
- 2026-05-10: Vulnerability found
- 2026-05-10: Net-CIDR-Lite version 0.24 released
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
