Skip to main content

Net CVE-2026-40199

| EUVDEUVD-2026-21611 MEDIUM
Improper Handling of Length Parameter Inconsistency (CWE-130)
2026-04-10 9b29abf9-4ab0-4765-b253-1875cd9b441e GHSA-932w-96j4-j35v
Authentication Bypass Net Stigtsp
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

5
Patch available
Apr 16, 2026 - 05:29 EUVD
0.23
Analysis Generated
Apr 15, 2026 - 12:46 vuln.today
CVSS changed
Apr 13, 2026 - 15:22 NVD
6.5 (MEDIUM)
EUVD ID Assigned
Apr 10, 2026 - 22:22 euvd
EUVD-2026-21611
CVE Published
Apr 10, 2026 - 22:16 nvd
N/A

DescriptionCVE.org

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.

_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.

The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.

Example:

my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0");

incorrectly returns true

This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).

See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

AnalysisAI

Net::CIDR::Lite before version 0.23 for Perl incorrectly handles RFC 4291 IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) by including an extra sentinel byte during packing, resulting in 18-byte instead of 17-byte representations. This misalignment causes the find() and bin_find() functions to return incorrect matching results during IP address lookup operations, enabling attackers to bypass IP-based access control lists by crafting addresses that fall outside intended CIDR ranges. No active exploitation has been identified, but the low EPSS score (0.02%) masks the authentication bypass tag, suggesting limited real-world triggering conditions despite the 6.5 CVSS score.

Technical ContextAI

Net::CIDR::Lite is a Perl module that manages Classless Inter-Domain Routing (CIDR) address ranges and performs IP address lookups using packed binary representations. The vulnerability resides in the _pack_ipv6() function, which improperly constructs the binary format of IPv4-mapped IPv6 addresses by copying a sentinel byte from _pack_ipv4() that should not be included in the final 16-byte IPv6 representation. IPv4-mapped addresses follow RFC 4291 format (::ffff:192.0.2.1), where the first 80 bits are zero, the next 16 bits are 0xFFFF, and the final 32 bits contain the IPv4 address. The 18-byte malformed output breaks subsequent bitwise AND mask operations (which truncate to the shorter operand length) and string comparison operations (Perl's lt/gt lexical operators) used in range matching logic, causing the find() method to incorrectly include or exclude addresses from ACL-protected ranges. CWE-130 (Improper Handling of Length Parameter Inconsistency) directly describes this sentinel byte inclusion flaw.

RemediationAI

Upgrade Net::CIDR::Lite to version 0.23 or later immediately. For Perl installations using CPAN, run cpan Net::CIDR::Lite or cpanm Net::CIDR::Lite to fetch the patched release. Verify the installed version with perl -MNet::CIDR::Lite -e 'print $Net::CIDR::Lite::VERSION' to confirm version 0.23 or higher. If upgrading is not immediately feasible, audit ACL configurations that depend on IPv4-mapped IPv6 address ranges (::ffff:0:0/96) and add explicit filter rules to reject or validate IPv4-mapped addresses at the application layer. See the official advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-40199 and the CPAN changes log for additional context.

More in Net

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2023-38180 HIGH
7.5 Aug 08

.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
CVE-2026-62886 HIGH POC
7.8 Aug 11

Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
CVE-2026-62871 HIGH POC
7.8 Aug 11

Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
CVE-2026-70354 HIGH POC
7.8 Aug 11

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full

CVE-2026-62909 HIGH POC
7.8 Aug 11

Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows

CVE-2026-62901 HIGH POC
7.5 Aug 11

Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang

CVE-2026-62897 HIGH POC
7.0 Aug 11

Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
CVE-2026-62898 HIGH POC
7.5 Aug 11

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
CVE-2026-26127 HIGH POC
7.5 Mar 10

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]
CVE-2026-33811 HIGH POC
7.5 May 07

Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
CVE-2026-39836 HIGH POC
7.5 May 07

Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by

Same weakness CWE-130 – Improper Handling of Length Parameter Inconsistency

View all
CVE-2022-1543 HIGH POC
8.8
CVE-2022-3290 HIGH POC
7.5
CVE-2022-3272 HIGH POC
7.5
CVE-2022-2714 CRITICAL
9.8
CVE-2021-20588 CRITICAL
9.8
CVE-2026-67292 CRITICAL
9.3
CVE-2024-42460 MEDIUM POC
5.3
CVE-2026-54466 CRITICAL
9.2

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-40199 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy