Net::CIDR::Set CVE-2026-49941

Exploitation requires that the target application calls Net::CIDR::Set->add() (or another method that funnels through _encode()) on attacker-controlled string input without first validating that the string is a well-formed IPv4 or IPv6 address or CIDR range; any malformed string that fails the internal netmask and range regex checks will trigger the indefinite recursion. No authentication, user interaction, or special platform is required beyond network reachability to such an input path, and the affected module version must be 0.20 or earlier. Exploitation is LIMITED to availability impact (no code execution or data disclosure), and applications that already sanitise IP input upstream - or that do not expose this code path to untrusted data - are not practically reachable.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields 7.5 (High) and accurately captures the impact profile: network-reachable, no authentication, low complexity, availability-only impact. Real-world risk depends entirely on whether an exposed application passes attacker-controlled strings into Net::CIDR::Set->add(); in such applications (firewall rule builders, ACL parsers, IP allowlist forms, log analyzers, abuse-management tools) the bug is a trivial DoS primitive that crashes a worker per request. EPSS data was not provided in this intelligence packet, the CVE is not listed in CISA KEV, and no public exploit code was identified, so real-world exploitation pressure is currently low to moderate; however, the trigger is so simple that weaponization is essentially the act of submitting any non-IP string, and stack-exhaustion DoS against Perl long-running processes (mod_perl, Mojolicious, Plack/Starman workers) is a realistic concern wherever the module touches untrusted input.

An attacker identifies a web endpoint that accepts an IP or CIDR string (for example an allowlist form, abuse-report API, or firewall management UI) backed by a Perl service using Net::CIDR::Set. They submit a malformed value such as 'notanip' or '999.999.999.999'; the add() method recurses indefinitely, exhausts the worker stack, and the request handler dies. Repeating the request against multiple workers cheaply saturates the application pool and denies service to legitimate users.