Skip to main content

Net EUVDEUVD-2026-21609

| CVE-2026-40198 HIGH
Improper Validation of Syntactic Correctness of Input (CWE-1286)
2026-04-10 9b29abf9-4ab0-4765-b253-1875cd9b441e
Authentication Bypass Net Stigtsp
7.5
CVSS 3.1 · Vendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malformed IPv6 address with incorrect group count
  2. Exploit
    Pass to Net::CIDR::Lite parsing function
  3. Execution
    Generate incorrectly-packed binary value
  4. Impact
    Bypass IP ACL checks via string comparison

Vulnerability Assessment

Weakness
CWE
CWE-1286
ASVS 5.0
V15 - Secure Coding and Architecture Hardware access control granularity
Exploitation Conditions

Application must use Net::CIDR::Lite versions before 0.23 for Perl to validate IPv6 addresses in access control lists or IP filtering logic. No authentication required; exploitation occurs during normal IPv6 address validation.
Impact

Real-world exploitation risk is moderate despite the 7.5 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation requiring no authentication or user interaction, which would normally signal high urgency. However, the EPSS score of 0.03% (10th percentile) suggests attackers are not actively targeting this vulnerability class. No CISA KEV listing exists, and no public exploit code has been identified at time of analysis. The high integrity impact (I:H) is realistic-successful exploitation directly undermines IP-based access controls, potentially allowing unauthorized network access or bypassing security zones. The critical qualifier is deployment context: this only affects systems using Net::CIDR::Lite for security-critical ACL decisions (firewall rules, authentication gates, API rate limiting by IP). Many Perl applications use this library for non-security purposes like network statistics or routing logic, where the impact would be negligible. According to SSVC decision framework: exploitation status is 'none' (no public POC), automatable is 'yes' (simple HTTP request if exposed via web interface), and technical impact is 'partial' (integrity loss in access control subsystem). This places the vulnerability in a 'scheduled' remediation track for most organizations, elevated to 'out-of-band' only for internet-facing systems using IPv6 ACLs with this library version.
Exploit ScenarioDerived

An attacker identifies a web application firewall or API gateway written in Perl that uses Net::CIDR::Lite <0.23 to enforce IP allowlists for administrative endpoints. The
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 15, 2026

IPv6 address validation bypass in Net::CIDR::Lite for Perl (versions <0.23) allows remote attackers to circumvent IP access control lists without authentication. The _pack_ipv6() function fails to validate that uncompressed IPv6 addresses contain exactly 8 hexadecimal groups, accepting malformed inputs like 'abcd' or '1:2:3' and producing incorrect packed representations. This causes find() and bin_find() methods to incorrectly match addresses against CIDR ranges, enabling ACL bypass. Exploitati

Earlier versions of this analysis (1)
v1 Apr 15, 2026 - 12:29 CVSS 7.5

IPv6 address validation bypass in Net::CIDR::Lite for Perl (versions <0.23) allows remote attackers to circumvent IP access control lists without authentication. The _pack_ipv6() function fails to validate that uncompressed IPv6 addresses contain exactly 8 hexadecimal groups, accepting malformed inputs like 'abcd' or '1:2:3' and producing incorrect packed representations. This causes find() and bin_find() methods to incorrectly match addresses against CIDR ranges, enabling ACL bypass. Exploitation probability is low (EPSS 3%, 10th percentile) with no confirmed active exploitation or public POC, but the high integrity impact (CVSS I:H) and trivial attack complexity make this a priority for systems using this library for network access control.

RemediationAI

Upgrade Net::CIDR::Lite to version 0.23 or later, which includes validation to ensure IPv6 addresses contain exactly 8 hexadecimal groups when not using double-colon compression. The patch is available via CPAN with installation command 'cpan Net::CIDR::Lite' or 'cpanm Net::CIDR::Lite'. The specific fix is documented in commit 25d65f85dbe4885959a10471725ec9d250a589c3 at https://github.com/stigtsp/Net-CIDR-Lite/commit/25d65f85dbe4885959a10471725ec9d250a589c3.patch. For environments where immediate upgrade is not feasible, implement input validation at the application layer to reject malformed IPv6 addresses before passing them to Net::CIDR::Lite methods-validate that inputs match the regex pattern for properly formatted IPv6 addresses (8 colon-separated hex groups or valid double-colon compression). Alternatively, switch to alternative CIDR libraries such as Net::Netmask or NetAddr::IP which have different validation implementations. Review application logs for suspicious IPv6 addresses with fewer than 8 groups to identify potential exploitation attempts. Release notes at https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes detail all fixes in version 0.23.

Affected VersionsENISA

Net::CIDR::Lite 0 <0.23

Affected Packages

euvd net_cidr_lite fix: 0.23

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Net::CIDR::Lite is a Perl module for manipulating IPv4 and IPv6 CIDR (Classless Inter-Domain Routing) blocks, commonly used for IP allowlisting, denylisting, and network access control logic. The vulnerability lies in the _pack_ipv6() internal function, which converts IPv6 addresses to packed binary representations for comparison operations. According to RFC 4291, uncompressed IPv6 addresses must contain exactly 8 colon-separated hexadecimal groups (e.g., '2001:0db8:0000:0000:0000:8a2e:0370:7334'). The flawed implementation skips this validation step, accepting inputs with fewer groups and producing packed strings of incorrect lengths-3, 7, or 15 bytes instead of the expected 17 bytes (16 for the address plus 1 for prefix length). The find() and bin_find() methods then use Perl's lexical string comparison operators (lt/gt) on these malformed packed values. Comparing strings of different byte lengths produces semantically meaningless results, causing range membership tests to return incorrect true/false values. This is classified as CWE-1286 (Improper Validation of Syntactic Correctness of Input), representing the same vulnerability pattern previously addressed for IPv4 in CVE-2021-47154, where leading zeros in IPv4 octets caused similar bypass issues.

Know when Net gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SUSE HIGH

Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).

CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

4
Analysis Updated
Apr 16, 2026 - 05:57 EUVD-patch-fix
executive summary
Patch available
Apr 16, 2026 - 05:29 EUVD
0.23
CVSS changed
Apr 13, 2026 - 15:22 NVD
7.5 (HIGH)
CVE Published
Apr 10, 2026 - 22:16 nvd
N/A

DescriptionCVE.org

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.

_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).

The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.

Example:

my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3");

invalid input, incorrectly returns true

This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.

See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

Executive ViewAI

Why It Matters

Net::CIDR::Lite for Perl versions before 0.23 contain an IPv6 validation flaw that allows unauthenticated attackers to bypass IP-based access control lists by submitting malformed IPv6 addresses, directly undermining network segmentation and authentication enforcement mechanisms that organizations rely on for perimeter security.

Business Impact: High
Compensating Controls

Apply vendor patch. Interim mitigation: Implement additional IPv6 address format validation at the application layer before passing to Net::CIDR::Lite functions; enforce stricter input sanitization requiring full RFC 4291 compliance (8 hexadecimal groups in uncompressed form); consider disabling IPv6 access temporarily if not operationally critical until patching is complete.

Threat Intelligence Overview

EPSS Score
0.0%
Top 90% exploitable
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Net

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2026-111497 CRITICAL POC
9.2 Oct 21

Remote code execution is possible in Node.js releases that bundle a vulnerable Brotli decoder: a malformed brotli-compre
CVE-2023-38180 HIGH
7.5 Aug 08

.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
CVE-2026-69439 HIGH POC
8.8 Sep 08

Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker
CVE-2026-71328 HIGH POC
8.8 Sep 08

Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
CVE-2026-62886 HIGH POC
7.8 Aug 11

Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
CVE-2026-62871 HIGH POC
7.8 Aug 11

Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
CVE-2026-70354 HIGH POC
7.8 Aug 11

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full

CVE-2026-62909 HIGH POC
7.8 Aug 11

Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows

CVE-2026-62901 HIGH POC
7.5 Aug 11

Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang

CVE-2026-62897 HIGH POC
7.0 Aug 11

Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
CVE-2026-62898 HIGH POC
7.5 Aug 11

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u

Same weakness CWE-1286 – Improper Validation of Syntactic Correctness of Input

View all
CVE-2026-109425 MEDIUM POC
6.9
CVE-2024-6284 MEDIUM POC
6.3
CVE-2026-110759 CRITICAL
9.8
CVE-2025-10954 MEDIUM POC
5.5
CVE-2026-102084 CRITICAL
9.2
CVE-2024-6763 MEDIUM POC
5.3
CVE-2026-87080 CRITICAL
9.1
CVE-2025-41719 HIGH
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-40198 ADVISORY https://ubuntu.com/security/notices/USN-8406-1 ADVISORY https://vuldb.com/vuln/356957 REF https://github.com/stigtsp/Net-CIDR-Lite/commit/25d65f85dbe4885959a10471725ec9d250a589c3.patch REF https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes REF https://www.cve.org/CVERecord?id=CVE-2026-40199

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy