Skip to content
Fencer Vulns
high 7.5

CVE-2026-40198 json

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass

published 2026-04-10 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-21609

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits
0
none known

Summary

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.

_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).

The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.

Example:

my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true

This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.

See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

Patch / fix

  • STIGTSP Net::CIDR::Lite 0.23
  • libnet-cidr-lite-perl Debian 12 0.22-3~deb12u1
  • libnet-cidr-lite-perl Debian 13 0.22-3~deb13u1
  • libnet-cidr-lite-perl Debian 14 0.22-3

debian advisories DEBIAN-CVE-2026-40198

  • libnet-cidr-lite-perl Ubuntu 22.04 LTS 0.22-1ubuntu0.1
  • libnet-cidr-lite-perl Ubuntu 24.04 LTS 0.22-2ubuntu0.24.04.1
  • libnet-cidr-lite-perl Ubuntu 25.10 0.22-2ubuntu0.25.10.1
  • libnet-cidr-lite-perl Ubuntu 26.04 LTS 0.22-2ubuntu0.26.04.1
  • libnet-cidr-lite-perl Ubuntu Pro 16.04 LTS 0.21-1ubuntu0.16.04.1~esm1
  • libnet-cidr-lite-perl Ubuntu Pro 18.04 LTS 0.21-1ubuntu0.18.04.1~esm1
  • libnet-cidr-lite-perl Ubuntu Pro 20.04 LTS 0.21-2ubuntu0.1+esm1

ubuntu advisories UBUNTU-CVE-2026-40198

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl-Net-CIDR-Lite openSUSE Tumbleweed 0.240.0-1.1

opensuse advisories openSUSE-SU-2026:10780-1

  • perl-net-cidr-lite Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 0.23-r0

alpine advisories ALPINE-CVE-2026-40198

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

  • STIGTSP Net::CIDR::Lite

Classification

Weakness
  • CWE-1286 Improper Validation of Syntactic Correctness of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.