CVE-2026-45190

Summary

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.

Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.

Example:

my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true

See also CVE-2026-45191.

Affected Software

VendorProductVersion RangeStatus
STIGTSPNet::CIDR::Lite0 < 0.24affected

Weaknesses

  • CWE-1289: CWE-1289 Improper Validation of Unsafe Equivalence in Input

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References