Net CVE-2026-40199

The vulnerability is triggered when an application using Net::CIDR::Lite receives or processes valid RFC 4291 IPv4-mapped IPv6 addresses in the format ::ffff:x.x.x.x AND the application uses the find() or bin_find() methods to validate addresses against CIDR ranges containing IPv4-mapped addresses. The condition is specific to IPv4-mapped IPv6 address handling; standard IPv6 or pure IPv4 CIDR operations are not affected. Malformed IPv6 addresses are separately addressed by CVE-2026-40198.

The CVSS 6.5 score reflects medium impact (Confidentiality: Low, Integrity: Low, Availability: None) with network accessibility and low complexity, but real-world risk is substantially lower than this suggests. The EPSS score of 0.02% (4th percentile) indicates minimal exploitation probability in the wild, likely because the vulnerability requires (1) a Perl-based application using Net::CIDR::Lite for ACL enforcement, (2) reliance on IPv4-mapped IPv6 address handling specifically, and (3) the attacker to control or craft IPv4-mapped addresses within the network. The authentication bypass tag conflicts with the attack vector (AV:N/PR:N), which typically indicates pre-authentication attacks, suggesting the tag may be mislabeled or refers to bypassing IP-based authentication schemes specifically. The two-step attack chain (send IPv4-mapped address → trigger misaligned comparison) has low barrier to execution but limited exploit surface. This is a real vulnerability but primarily affects specialized deployments; organizations using Net::CIDR::Lite for IPv6 ACLs should prioritize patching, while others can schedule standard updates.

An attacker targeting an IPv6-enabled application that uses Net::CIDR::Lite for IP-based access control discovers that a protected network range (e.g., ::ffff:192.168.1.0/120) is configured. By crafting an IPv4-mapped IPv6 address request (e.g., ::ffff:192.168.2.0) that should fall outside this CIDR range, the attacker exploits the 18-byte packing misalignment to trigger incorrect string comparison, causing the find() method to return a false match and bypass the ACL. This grants unauthorized access to APIs, web services, or data resources protected by that CIDR rule.