CVE-2026-45191

Name
CVE-2026-45191
Description
Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass. Mask forms like "/00" and "/01" pass validation and parse to the same prefix as their unpadded value. See also CVE-2026-45190.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
9b29abf9-4ab0-4765-b253-1875cd9b441e https://github.com/stigtsp/Net-CIDR-Lite/commit/24e2c439ec405e5256024b9acefd4f7008c5ed0c.patch
9b29abf9-4ab0-4765-b253-1875cd9b441e https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes
9b29abf9-4ab0-4765-b253-1875cd9b441e https://www.cve.org/CVERecord?id=CVE-2026-45190

Match rules

CPE URI Source package Min version Max version

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
perl-net-cidr-lite edge-main 0.24-r0 None fixed
perl-net-cidr-lite 3.24-main 0.24-r0 None fixed