Log in Start free

Vulnerability · Published Jun 4, 2026 · Assigned by CPANSec

CVE-2026-49942Net::CIDR::Set versions through 0.20 for Perl did not validate network masks

High 7.3

In plain English

A high-severity security flaw in Net::CIDR::Set from RRWO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 77.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks. Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libnet-cidr-set-perlno fix listedDEBIAN-CVE-2026-49942
Debian:13libnet-cidr-set-perl0.15-1+deb13u1DEBIAN-CVE-2026-49942
Debian:14libnet-cidr-set-perl0.21-1DEBIAN-CVE-2026-49942
Ubuntu:22.04:LTSlibnet-cidr-set-perlno fix listedUBUNTU-CVE-2026-49942
Ubuntu:24.04:LTSlibnet-cidr-set-perlno fix listedUBUNTU-CVE-2026-49942
Ubuntu:25.10libnet-cidr-set-perlno fix listedUBUNTU-CVE-2026-49942
Ubuntu:26.04:LTSlibnet-cidr-set-perlno fix listedUBUNTU-CVE-2026-49942
Ubuntu:26.10libnet-cidr-set-perlno fix listedUBUNTU-CVE-2026-49942

Affected products (as reported)

VendorProductVersions
RRWO Net::CIDR::Set 0 – through 0.20

Weakness: CWE-1289 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References