Skip to main content

Net CVE-2026-40198

| EUVDEUVD-2026-21609 HIGH
Improper Validation of Syntactic Correctness of Input (CWE-1286)
2026-04-10 9b29abf9-4ab0-4765-b253-1875cd9b441e
Authentication Bypass Net
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

8
Re-analysis Queued
Apr 21, 2026 - 18:52 vuln.today
cvss_changed
Analysis Updated
Apr 16, 2026 - 05:57 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
0.23
Analysis Generated
Apr 15, 2026 - 12:29 vuln.today
CVSS changed
Apr 13, 2026 - 15:22 NVD
7.5 (HIGH)
EUVD ID Assigned
Apr 10, 2026 - 22:22 euvd
EUVD-2026-21609
CVE Published
Apr 10, 2026 - 22:16 nvd
N/A

DescriptionCVE.org

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.

_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).

The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.

Example:

my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3");

invalid input, incorrectly returns true

This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.

See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

AnalysisAI

IPv6 address validation bypass in Net::CIDR::Lite for Perl (versions <0.23) allows remote attackers to circumvent IP access control lists without authentication. The _pack_ipv6() function fails to validate that uncompressed IPv6 addresses contain exactly 8 hexadecimal groups, accepting malformed inputs like 'abcd' or '1:2:3' and producing incorrect packed representations. This causes find() and bin_find() methods to incorrectly match addresses against CIDR ranges, enabling ACL bypass. Exploitati

Technical ContextAI

Net::CIDR::Lite is a Perl module for manipulating IPv4 and IPv6 CIDR (Classless Inter-Domain Routing) blocks, commonly used for IP allowlisting, denylisting, and network access control logic. The vulnerability lies in the _pack_ipv6() internal function, which converts IPv6 addresses to packed binary representations for comparison operations. According to RFC 4291, uncompressed IPv6 addresses must contain exactly 8 colon-separated hexadecimal groups (e.g., '2001:0db8:0000:0000:0000:8a2e:0370:7334'). The flawed implementation skips this validation step, accepting inputs with fewer groups and producing packed strings of incorrect lengths-3, 7, or 15 bytes instead of the expected 17 bytes (16 for the address plus 1 for prefix length). The find() and bin_find() methods then use Perl's lexical string comparison operators (lt/gt) on these malformed packed values. Comparing strings of different byte lengths produces semantically meaningless results, causing range membership tests to return incorrect true/false values. This is classified as CWE-1286 (Improper Validation of Syntactic Correctness of Input), representing the same vulnerability pattern previously addressed for IPv4 in CVE-2021-47154, where leading zeros in IPv4 octets caused similar bypass issues.

RemediationAI

Upgrade Net::CIDR::Lite to version 0.23 or later, which includes validation to ensure IPv6 addresses contain exactly 8 hexadecimal groups when not using double-colon compression. The patch is available via CPAN with installation command 'cpan Net::CIDR::Lite' or 'cpanm Net::CIDR::Lite'. The specific fix is documented in commit 25d65f85dbe4885959a10471725ec9d250a589c3 at https://github.com/stigtsp/Net-CIDR-Lite/commit/25d65f85dbe4885959a10471725ec9d250a589c3.patch. For environments where immediate upgrade is not feasible, implement input validation at the application layer to reject malformed IPv6 addresses before passing them to Net::CIDR::Lite methods-validate that inputs match the regex pattern for properly formatted IPv6 addresses (8 colon-separated hex groups or valid double-colon compression). Alternatively, switch to alternative CIDR libraries such as Net::Netmask or NetAddr::IP which have different validation implementations. Review application logs for suspicious IPv6 addresses with fewer than 8 groups to identify potential exploitation attempts. Release notes at https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes detail all fixes in version 0.23.

More in Net

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2023-38180 HIGH
7.5 Aug 08

.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
CVE-2026-62886 HIGH POC
7.8 Aug 11

Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
CVE-2026-62871 HIGH POC
7.8 Aug 11

Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
CVE-2026-70354 HIGH POC
7.8 Aug 11

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full

CVE-2026-62909 HIGH POC
7.8 Aug 11

Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows

CVE-2026-62901 HIGH POC
7.5 Aug 11

Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang

CVE-2026-62897 HIGH POC
7.0 Aug 11

Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
CVE-2026-62898 HIGH POC
7.5 Aug 11

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
CVE-2026-33811 HIGH POC
7.5 May 07

Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
CVE-2026-39836 HIGH POC
7.5 May 07

Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by
CVE-2018-17848 HIGH POC
7.5 Oct 01

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "

Same weakness CWE-1286 – Improper Validation of Syntactic Correctness of Input

View all
CVE-2024-6284 MEDIUM POC
6.3
CVE-2025-10954 MEDIUM POC
5.5
CVE-2024-6763 MEDIUM POC
5.3
CVE-2021-31988 HIGH
8.8
CVE-2026-57026 HIGH
8.7
CVE-2026-33778 HIGH
8.7
CVE-2025-8873 HIGH
8.7
CVE-2024-39542 HIGH
8.7

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-40198 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy