EUVD-2026-34297
GHSA-hpv8-77xm-27wx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks.
Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers. This could allow network masks to accept larger networks.
AnalysisAI
Net::CIDR::Set versions through 0.20 for Perl incorrectly accepts Unicode digits in IP addresses and CIDR netmasks, enabling network access controls to silently permit broader address ranges than intended. Applications relying on this library to enforce IP-based allowlists or blocklists may inadvertently grant or deny access to incorrect network ranges when Unicode look-alike digits (e.g., Arabic-Indic U+0661 instead of ASCII '1') are supplied as input. With no public exploit identified at time of analysis and SSVC exploitation status of none, this is a medium-severity library flaw requiring patch deployment rather than emergency response, but the automatable nature of the attack vector warrants prompt remediation in access-control-sensitive deployments.
Technical ContextAI
Net::CIDR::Set is a Perl CPAN module (publisher: RRWO) for managing sets of IP network ranges expressed in CIDR notation, commonly used in access control, firewall rule management, and IP filtering logic. The vulnerability is classified under CWE-1289 (Improper Validation of Consistency within Input), meaning the library fails to enforce consistency between what characters it accepts and what it meaningfully parses. Specifically, Unicode decimal digit characters - such as the Arabic-Indic digit ONE (U+0661, visually '١') - fall within Unicode's Nd (decimal digit) character category and may pass loose regex or character-class checks, yet are not equivalent to ASCII '1' (U+0031) in numeric parsing contexts. When such characters appear in a netmask (e.g., /2٤ instead of /24), the library misinterprets the numeric value, yielding an incorrect prefix length and thus a different - potentially far larger - network range. The affected CPE is cpe:2.3:a:rrwo:net::cidr::set:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade to Net::CIDR::Set version 0.21, which is the vendor-released patch as confirmed by the RRWO changelog on MetaCPAN (https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changes). Using CPAN or cpanm: run 'cpan Net::CIDR::Set' or 'cpanm Net::CIDR::Set' to pull the latest release. The oss-security advisory (https://seclists.org/oss-sec/2026/q2/814) provides disclosure details. If an immediate upgrade is not possible, applications should sanitize all externally-supplied IP address and CIDR input by stripping or rejecting any non-ASCII characters before passing values to Net::CIDR::Set - for example, enforcing a strict regex such as /^[0-9a-fA-F.:/]+$/ prior to library calls. This workaround adds an input validation layer but does not fix the underlying library defect and should be treated as temporary only. Applications that accept CIDR input only from trusted internal sources (not user-supplied) have significantly reduced exposure.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today