Net::CIDR::Set CVE-2026-49942

Exploitation requires a host Perl application that (1) uses Net::CIDR::Set ≤ 0.20 to parse CIDR strings, (2) accepts those strings from an attacker-influenced source (user input, configuration uploaded by a less-privileged tenant, federated policy feed, etc.), and (3) uses the resulting set to make a security decision such as ACL evaluation, firewall rule generation, or rate-limit scoping. Limiting factors: the vulnerability is not exploitable against applications that hard-code CIDRs in trusted config, nor against applications that pre-validate inputs with a strict ASCII numeric regex; impact is also bounded by what the gated resource exposes. The CVSS PR:N/UI:N apply only to the library's parsing surface - real-world reachability is determined by the consuming application's exposure.

The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L describes a network-reachable, low-complexity, unauthenticated weakness with low impact in all three CIA dimensions, yielding 7.3 (High). However, exploitability is entirely dependent on whether a consuming application uses Net::CIDR::Set to make security-relevant decisions on attacker-influenced CIDR input - a deployment-specific condition the base score cannot capture. There is no EPSS score, KEV listing, or public POC referenced in the provided intelligence, suggesting this is a latent library defect rather than an actively weaponized issue. The 'Information Disclosure' tag and L/L/L impacts are consistent with the realistic worst case being authorization bypass to data or services the gated network was meant to protect, not direct RCE. Note that the CVSS vector's AV:N is generous: the vulnerability is in a parsing library, so 'network' reachability requires the host application to expose the parser to remote input.

An attacker submits a CIDR allow-list entry such as '10.0.0.0/٨' (where ٨ is the Arabic-Indic digit 8, U+0668) or '10.0.0.0/08' to a web admin form that uses Net::CIDR::Set to decide which source IPs may reach an internal API. The module silently strips the non-ASCII digit or misinterprets the leading zero, producing a set covering a much larger range (e.g., /0 or an unexpected mask), and the attacker subsequently connects from an IP that should have been denied. No public POC is referenced, but the bug class is trivial to trigger once the input path is identified.