EUVD-2026-72526
GHSA-456r-qjr2-xph9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Allow-list bypass grants universal access (I:H); deny-list poisoning blocks all traffic (A:H); no confidentiality impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
6DescriptionCVE.org
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.
Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table.
The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.
AnalysisAI
Input validation failure in Net::IP::LPM before 1.12 for Perl allows malformed CIDR prefix lengths to silently poison the longest-prefix-match lookup table. Non-numeric strings, Unicode digits (Arabic-Indic, fullwidth), hex notation, and integers exceeding 31 bits are all accepted and numified to zero or silently truncated by the XS/C layer, causing the malformed entry to be recorded as a /0 default route. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that attacker-controlled data reaches the Net::IP::LPM::add() function as the prefix string argument. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 and identifies only an availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Net::IP::LPM to version 1.12 or later via CPAN: 'cpan Net::IP::LPM' or 'cpanm Net::IP::LPM'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems using Net::IP::LPM through dependency scanning and configuration review. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today