CVE-2026-49941 Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses
HighCVSS 7.5
EPSS 0.33%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses.
The add method called the _encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and passed back to itself as a 32-bit or 128-bit netmask.
If the argument was not a well-formed IP address, then this would lead to indefinite recursion.
An attacker could use this to cause a denial of service.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| RRWO Net::CIDR::Set | <= 0.20 | No fix listed |
| debian/libnet-cidr-set-perl(Debian:12) | All versions | No fix listed |
| debian/libnet-cidr-set-perl(Debian:12) | = 0.13-4 | No fix listed |
| debian/libnet-cidr-set-perl(Debian:12) | = 0.13-5 | No fix listed |
| debian/libnet-cidr-set-perl(Debian:12) | = 0.15-1 | No fix listed |
| debian/libnet-cidr-set-perl(Debian:12) | = 0.19-1 | No fix listed |
| debian/libnet-cidr-set-perl(Debian:12) | = 0.20-1 | No fix listed |
| debian/libnet-cidr-set-perl(Debian:12) | = 0.21-1 | No fix listed |
| debian/libnet-cidr-set-perl(Debian:12) | = 0.22-1 | No fix listed |
| debian/libnet-cidr-set-perl(Debian:12) | = 0.23-1 | No fix listed |
| debian/libnet-cidr-set-perl(Debian:13) | < 0.15-1+deb13u1 | 0.15-1+deb13u1 |
| debian/libnet-cidr-set-perl(Debian:13) | = 0.15-1 | No fix listed |
| debian/libnet-cidr-set-perl(Debian:14) | < 0.21-1 | 0.21-1 |
| debian/libnet-cidr-set-perl(Debian:14) | = 0.15-1 | No fix listed |
| debian/libnet-cidr-set-perl(Debian:14) | = 0.19-1 | No fix listed |
| debian/libnet-cidr-set-perl(Debian:14) | = 0.20-1 | No fix listed |
| ubuntu/libnet-cidr-set-perl(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/libnet-cidr-set-perl(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libnet-cidr-set-perl(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libnet-cidr-set-perl(Ubuntu:26.10) | All versions | No fix listed |
| RRWO Net::CIDR::Set | < 0.21 | 0.21 |
References
- metacpan.org release-notes
- www.openwall.com mailing-list third-party-advisory
- Debian Security Tracker CVE-2026-49941 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org