PT-2026-22248 · Net::Cidr+2 · Net::Cidr+2

Published 2021-01-01 · Updated 2026-05-12 · CVE-2021-4456

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Net::CIDR versions prior to 0.24

Description The software mishandles leading zeros in IP CIDR addresses, potentially leading to an unspecified impact. The addr2cidr and cidrlookup functions can return leading zeros within a CIDR string, which could be interpreted as octal numbers. This may allow an attacker to bypass IP address-based access controls. The documentation suggests using the cidrvalidate function to validate untrusted CIDR strings, but this mitigation is optional and not enforced by default. Users may call addr2cidr or cidrlookup with untrusted input without validation, incorrectly assuming it is safe.

Recommendations Versions prior to 0.24 should be updated to version 0.24 or later.

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2021-4456

OPENSUSE-SU-2026:10756-1

OPENSUSE-SU-2026:20773-1

USN-8110-1

Affected Products

Linuxmint

Net::Cidr

Ubuntu

References · 19

• https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-4456 · Security Note
• https://ubuntu.com/security/notices/USN-8110-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-4456 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-4456 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4456 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-4456 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8110-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-4456 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10756-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-4456 · Security Note
• https://twitter.com/CVEnew/status/2027380247637737517 · Twitter Post
• https://twitter.com/infoflowcloud/status/2027382444060467557 · Twitter Post
• https://metacpan.org/dist/Net-CIDR/changes · Note
• https://t.me/cveNotify/153391 · Telegram Post