Skip to main content

Suse CVE-2021-4456

MEDIUM
Incorrect Type Conversion or Cast (CWE-704)
2026-02-27 9b29abf9-4ab0-4765-b253-1875cd9b441e
Authentication Bypass Suse
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
Patch released
Mar 03, 2026 - 20:25 nvd
Patch available
CVE Published
Feb 27, 2026 - 01:16 nvd
MEDIUM 6.5

DescriptionCVE.org

Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.

The functions addr2cidr and cidrlookup may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.

The documentation advises validating untrusted CIDR strings with the cidrvalidate function. However, this mitigation is optional and not enforced by default. In practice, users may call addr2cidr or cidrlookup with untrusted input and without validation, incorrectly assuming that this is safe.

AnalysisAI

Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions addr2cidr and cidrlookup may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. [CVSS 6.5 MEDIUM]

Technical ContextAI

Classified as CWE-704 (Incorrect Type Conversion or Cast). Affects Net\. Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.

The functions addr2cidr and cidrlookup may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.

The documentation advises validating untrusted CIDR strings with the cidrvalidate function. However, this mitigation is

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

Same weakness CWE-704 – Incorrect Type Conversion or Cast

View all
CVE-2017-3106 HIGH POC
8.8
CVE-2025-41646 CRITICAL POC
9.8
CVE-2018-14403 CRITICAL POC
9.8
CVE-2021-28918 CRITICAL POC
9.1
CVE-2021-39173 HIGH POC
8.8
CVE-2018-6064 HIGH POC
8.8
CVE-2018-3843 HIGH POC
8.8
CVE-2022-3979 HIGH POC
8.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

Share

CVE-2021-4456 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy