Skip to content
Fencer Vulns
medium 6.5

CVE-2026-40199 json

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass

published 2026-04-10 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-21611

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits
0
none known

Summary

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.

_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.

The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.

Example:

my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true

This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).

See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

Patch / fix

  • STIGTSP Net::CIDR::Lite 0.23
  • libnet-cidr-lite-perl Debian 12 0.22-3~deb12u1
  • libnet-cidr-lite-perl Debian 13 0.22-3~deb13u1
  • libnet-cidr-lite-perl Debian 14 0.22-3

debian advisories DEBIAN-CVE-2026-40199

  • libnet-cidr-lite-perl Ubuntu 22.04 LTS 0.22-1ubuntu0.1
  • libnet-cidr-lite-perl Ubuntu 24.04 LTS 0.22-2ubuntu0.24.04.1
  • libnet-cidr-lite-perl Ubuntu 25.10 0.22-2ubuntu0.25.10.1
  • libnet-cidr-lite-perl Ubuntu 26.04 LTS 0.22-2ubuntu0.26.04.1
  • libnet-cidr-lite-perl Ubuntu Pro 16.04 LTS 0.21-1ubuntu0.16.04.1~esm1
  • libnet-cidr-lite-perl Ubuntu Pro 18.04 LTS 0.21-1ubuntu0.18.04.1~esm1
  • libnet-cidr-lite-perl Ubuntu Pro 20.04 LTS 0.21-2ubuntu0.1+esm1

ubuntu advisories UBUNTU-CVE-2026-40199

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl-Net-CIDR-Lite openSUSE Tumbleweed 0.240.0-1.1

opensuse advisories openSUSE-SU-2026:10780-1

  • perl-net-cidr-lite Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 0.23-r0

alpine advisories ALPINE-CVE-2026-40199

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

  • STIGTSP Net::CIDR::Lite

Classification

Weakness
  • CWE-130 Improper Handling of Length Parameter Inconsistency

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.