Vulnerability · Published Jun 27, 2025 · Assigned by CPANSec
CVE-2025-40910Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses
Medium 6.5
In plain English
A medium-severity security flaw in Net-IP-LPM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 73.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Net-IP-LPM | 1.10 |
Weakness: CWE-1287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://metacpan.org/release/TPODER/Net-IP-LPM-1.10/diff/TPODER/Net-IP-LPM-1.09/lib/Net/IP/LPM.pm
- https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/
- https://security.metacpan.org/patches/N/Net-IP-LPM/1.10/CVE-2025-40910-r1.patch patch
- https://rt.cpan.org/Ticket/Display.html?id=179855 issue-tracking, vendor-advisory
- https://metacpan.org/release/RRWO/Net-IP-LPM-1.11/changes release-notes