PT-2026-32049 · Unknown · Net-Cidr-Lite

Published 2026-04-10 · Updated 2026-05-14 · CVE-2026-40199

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Net::CIDR::Lite versions prior to 0.23

Description Net::CIDR::Lite versions before 0.23 for Perl incorrectly handles IPv4 mapped IPv6 addresses, potentially allowing IP ACL bypass. The pack ipv6() function includes a sentinel byte from pack ipv4() when creating the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1, resulting in an incorrect length of 18 bytes instead of 17. This length mismatch causes issues in mask operations and address matching within the find() and bin find() functions, potentially leading to incorrect matches or misses. This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).

Recommendations Update Net::CIDR::Lite to version 0.23 or later.

Fix

Weakness Enumeration

CWE-130

Related Identifiers

CVE-2026-40199

OPENSUSE-SU-2026:10780-1

Affected Products

Net-Cidr-Lite

References · 19

• https://github.com/stigtsp/Net-CIDR-Lite/commit/b7166b1fa17b3b14b4c795ace5b3fbf71a0bd04a.patch · Patch
• https://cve.org/CVERecord?id=CVE-2026-40199 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40199 · Security Note
• https://ubuntu.com/security/CVE-2026-40199 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10780-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40199 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40198 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2026-40199 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40199 · Vendor Advisory
• https://lists.security.metacpan.org/cve-announce/msg/38785618 · Note
• https://twitter.com/oss_security/status/2042792705969791193 · Twitter Post
• https://suse.com/security/cve/CVE-2026-45191 · Note
• https://suse.com/security/cve/CVE-2026-45190 · Note
• https://suse.com/security/cve/CVE-2026-40198 · Note