Net::CIDR::Set CVE-2026-49940

The application must use Net::CIDR::Set (version ≤ 0.20) to parse IP addresses or CIDR notation that originates - directly or indirectly - from attacker-controlled input, such as user-submitted form fields, API parameters, HTTP headers, or configuration data loaded from external sources. No authentication is required and no user interaction is needed (PR:N, UI:N per CVSS vector). Exploitation is limited to scenarios where the misparsed CIDR value influences an access control decision, network filter evaluation, or similar security boundary; applications that use the library purely for display or logging purposes are not exploitable. Deployments where all CIDR input is internally sourced and never user-supplied are not at risk.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N scores 6.5 (Medium), indicating network-reachable exploitation requiring no authentication and no user interaction - a relatively low bar for triggering the flaw. Confidentiality and integrity are partially impacted (C:L/I:L), reflecting the risk of incorrect network boundary enforcement rather than direct data exfiltration or system compromise. The SSVC assessment aligns partially: Automatable:yes confirms that exploitation can be scripted at scale (any application exposing a CIDR-parsing endpoint is potentially mass-targetable), but Exploitation:none indicates no active exploitation has been observed. No EPSS score was provided in the input data, preventing probability-based prioritization. No CISA KEV listing exists. The real-world risk is context-dependent: in applications where Net::CIDR::Set controls network-level access decisions (e.g., VPN allowlists, API rate-limiting by IP block, firewall rule engines), the impact could be meaningful - incorrect masks could silently expand permitted address space. In applications where IP filtering is defense-in-depth rather than primary access control, risk is lower. CVSS and SSVC are consistent; no conflicting signals detected.

An attacker submits a crafted CIDR block containing Arabic-Indic or other Unicode decimal digits - for instance, supplying '192.168.١.0/٢٤' instead of '192.168.1.0/24' - to a web application or API that passes user-controlled input to Net::CIDR::Set for access control decisions. The library accepts the non-ASCII input, misparses the prefix length, and evaluates the resulting (incorrect) network range - potentially matching a far larger block of IP addresses than intended. No public exploit code has been identified at time of analysis, but the attack is straightforward to automate given no authentication or user interaction is required.