EUVD-2026-57150Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable with no authentication or user interaction; impact is availability-only via proportional memory allocation; no confidentiality or integrity loss confirmed from DoS path.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths.
The _encode method accepts any prefix length matching (0|[1-9][0-9]*) and passes it to _width2bits(), which builds the mask as '1' x ($width + 8), one character per bit. The _inc() method then unpacks the packed mask into a Perl array of one scalar per byte, so the prefix length alone sets the allocation size: ::/100000000 builds a 100 MB string and a 12.5 million element array. The value being tested is parsed, not just the configured ranges: contains() builds a set from its argument, and _guess_coder() tries the IPv4 coder and then the IPv6 coder, so an IPv4-only set expands an oversized IPv6 prefix length before the mixed address width check rejects it.
Any caller that passes untrusted input to contains() or add() can exhaust process memory. A prefix length above 128 is also stored as a range that does not match the requested block: 2001:db8::/129 stringifies back unchanged, contains() of its own base address returns false, and removing it from a set drops the base address while the set still prints as covering it.
AnalysisAI
Memory exhaustion in Net::CIDR::Set before 0.23 exposes any Perl application using the library to remote denial of service when untrusted input reaches contains() or add(). The _encode method in lib/Net/CIDR/Set/IPv6.pm accepted unbounded prefix lengths and allocated memory proportional to the supplied value - ::/100000000 produces a ~100 MB string and a 12.5 million-element Perl array before the input is rejected - with no authentication required (CVSS PR:N, AV:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an application passes externally-supplied CIDR strings to `contains()` or `add()` on a Net::CIDR::Set instance without first enforcing prefix length bounds. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is well-supported by the mechanism: network-reachable, zero authentication, no user interaction, with availability as the sole confirmed impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted HTTP request to a Perl web application that uses Net::CIDR::Set to validate IP allowlists or geofencing rules, supplying `::/100000000` as a CIDR parameter. The application passes this value to `contains()`, which invokes the IPv6 coder and allocates a ~100 MB string and a 12.5 million-element array before rejecting the input. … |
| Remediation | Upgrade to Net::CIDR::Set version 0.23 or later, confirmed available on CPAN with changelog at https://metacpan.org/release/RRWO/Net-CIDR-Set-0.23/changes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Perl applications using Net::CIDR::Set by reviewing dependency files (cpanfile, Makefile.PL, META.json) and assess which systems are internet-facing or process untrusted network input. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today