Skip to main content

Net CVE-2026-40199

| EUVDEUVD-2026-21611 MEDIUM
Improper Handling of Length Parameter Inconsistency (CWE-130)
2026-04-10 9b29abf9-4ab0-4765-b253-1875cd9b441e GHSA-932w-96j4-j35v
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

5
Patch available
Apr 16, 2026 - 05:29 EUVD
0.23
Analysis Generated
Apr 15, 2026 - 12:46 vuln.today
CVSS changed
Apr 13, 2026 - 15:22 NVD
6.5 (MEDIUM)
EUVD ID Assigned
Apr 10, 2026 - 22:22 euvd
EUVD-2026-21611
CVE Published
Apr 10, 2026 - 22:16 nvd
N/A

DescriptionCVE.org

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.

_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.

The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.

Example:

my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0");

incorrectly returns true

This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).

See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

AnalysisAI

Net::CIDR::Lite before version 0.23 for Perl incorrectly handles RFC 4291 IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) by including an extra sentinel byte during packing, resulting in 18-byte instead of 17-byte representations. This misalignment causes the find() and bin_find() functions to return incorrect matching results during IP address lookup operations, enabling attackers to bypass IP-based access control lists by crafting addresses that fall outside intended CIDR ranges. No active exploitation has been identified, but the low EPSS score (0.02%) masks the authentication bypass tag, suggesting limited real-world triggering conditions despite the 6.5 CVSS score.

Technical ContextAI

Net::CIDR::Lite is a Perl module that manages Classless Inter-Domain Routing (CIDR) address ranges and performs IP address lookups using packed binary representations. The vulnerability resides in the _pack_ipv6() function, which improperly constructs the binary format of IPv4-mapped IPv6 addresses by copying a sentinel byte from _pack_ipv4() that should not be included in the final 16-byte IPv6 representation. IPv4-mapped addresses follow RFC 4291 format (::ffff:192.0.2.1), where the first 80 bits are zero, the next 16 bits are 0xFFFF, and the final 32 bits contain the IPv4 address. The 18-byte malformed output breaks subsequent bitwise AND mask operations (which truncate to the shorter operand length) and string comparison operations (Perl's lt/gt lexical operators) used in range matching logic, causing the find() method to incorrectly include or exclude addresses from ACL-protected ranges. CWE-130 (Improper Handling of Length Parameter Inconsistency) directly describes this sentinel byte inclusion flaw.

RemediationAI

Upgrade Net::CIDR::Lite to version 0.23 or later immediately. For Perl installations using CPAN, run cpan Net::CIDR::Lite or cpanm Net::CIDR::Lite to fetch the patched release. Verify the installed version with perl -MNet::CIDR::Lite -e 'print $Net::CIDR::Lite::VERSION' to confirm version 0.23 or higher. If upgrading is not immediately feasible, audit ACL configurations that depend on IPv4-mapped IPv6 address ranges (::ffff:0:0/96) and add explicit filter rules to reject or validate IPv4-mapped addresses at the application layer. See the official advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-40199 and the CPAN changes log for additional context.

More in Net

View all
CVE-2026-33811 HIGH POC
7.5 May 07

Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali

CVE-2018-17848 HIGH POC
7.5 Oct 01

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "

CVE-2018-17847 HIGH POC
7.5 Oct 01

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading

CVE-2018-17143 HIGH POC
7.5 Sep 17

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a

CVE-2018-17142 HIGH POC
7.5 Sep 17

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "pani

CVE-2018-17075 HIGH POC
7.5 Sep 16

The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic:

CVE-2026-45491 MEDIUM POC
5.5 Jun 09

Local file tampering via symlink/junction following in Microsoft .NET runtimes 8.0, 9.0, and 10.0 allows a local unauthe

CVE-2024-43498 CRITICAL
9.8 Nov 12

.NET and Visual Studio Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is re

CVE-2023-36049 CRITICAL
9.8 Nov 14

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this v

CVE-2024-57854 CRITICAL
9.1 Mar 05

Weak PRNG in Net::NSCA::Client through 0.009002 for Perl. Patch available.

CVE-2026-11373 CRITICAL
9.1 Jun 22

Metric injection in the Perl module Net::Statsite::Client through version 1.1.0 allows attackers controlling metric name

CVE-2026-45591 HIGH
7.5 Jun 09

Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disru

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-40199 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy