Net::CIDR::Set CVE-2026-19566

Exploitation requires that an application passes externally-supplied CIDR strings to contains() or add() on a Net::CIDR::Set instance without first enforcing prefix length bounds. The attack surface extends to IPv4-only sets because _guess_coder() tries the IPv6 coder as a fallback before the mixed-width check fires, meaning full allocation occurs regardless of the set's configured address family. No authentication is required (CVSS PR:N) and no non-default server configuration is involved - this is the default code path for any prefix string passed to the library. Exploitation is constrained to deployments where attacker-controlled CIDR notation reaches library methods; applications that use only hardcoded or pre-validated ranges are not affected. The secondary correctness bug (prefix lengths above 128 stored as malformed ranges) can be triggered by the same input class and affects access control logic independently of the DoS.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is well-supported by the mechanism: network-reachable, zero authentication, no user interaction, with availability as the sole confirmed impact. The 16% EPSS score stands out - library-level DoS issues typically cluster far below 5%, suggesting meaningful interest from automated exploitation tooling or security researchers. No CISA KEV listing means active exploitation is unconfirmed, and no POC is identified in the provided sources, so these remain distinct signals. The secondary correctness bug (silent incorrect membership for prefix lengths above 128) is not captured by CVSS's I:N rating and represents a potential access control bypass in applications using Net::CIDR::Set for security-relevant allowlist or blocklist decisions - a signal the raw CVSS score understates. Overall this is a genuine operational priority: low complexity, no privileges, and any internet-facing Perl service that pipes user-controlled CIDR strings into library methods without prior length validation is directly exposed to a single-request DoS.

An attacker submits a crafted HTTP request to a Perl web application that uses Net::CIDR::Set to validate IP allowlists or geofencing rules, supplying ::/100000000 as a CIDR parameter. The application passes this value to contains(), which invokes the IPv6 coder and allocates a ~100 MB string and a 12.5 million-element array before rejecting the input. Repeated concurrent requests exhaust available process memory, triggering an OOM kill or crashing the application without any authenticated session.