Log in Start free

Vulnerability · Published Jun 4, 2026 · Assigned by CPANSec

CVE-2026-49941Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses

High 7.5

In plain English

A high-severity security flaw in Net::CIDR::Set from RRWO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 73.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. The add method called the _encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and passed back to itself as a 32-bit or 128-bit netmask. If the argument was not a well-formed IP address, then this would lead to indefinite recursion. An attacker could use this to cause a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libnet-cidr-set-perlno fix listedDEBIAN-CVE-2026-49941
Debian:13libnet-cidr-set-perl0.15-1+deb13u1DEBIAN-CVE-2026-49941
Debian:14libnet-cidr-set-perl0.21-1DEBIAN-CVE-2026-49941
Ubuntu:22.04:LTSlibnet-cidr-set-perlno fix listedUBUNTU-CVE-2026-49941
Ubuntu:24.04:LTSlibnet-cidr-set-perlno fix listedUBUNTU-CVE-2026-49941
Ubuntu:25.10libnet-cidr-set-perlno fix listedUBUNTU-CVE-2026-49941
Ubuntu:26.04:LTSlibnet-cidr-set-perlno fix listedUBUNTU-CVE-2026-49941
Ubuntu:26.10libnet-cidr-set-perlno fix listedUBUNTU-CVE-2026-49941

Affected products (as reported)

VendorProductVersions
RRWO Net::CIDR::Set 0 – through 0.20

Weakness: CWE-1287, CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References