EUVD-2026-34298
GHSA-wvxw-q92g-9ghf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses.
The add method called the _encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and passed back to itself as a 32-bit or 128-bit netmask.
If the argument was not a well-formed IP address, then this would lead to indefinite recursion.
An attacker could use this to cause a denial of service.
AnalysisAI
Denial of service in the Perl module Net::CIDR::Set through version 0.20 allows remote unauthenticated attackers to trigger indefinite recursion by submitting malformed IP address strings to the add() method. The flaw stems from missing input validation when parsing addresses, causing the parser to re-enter itself without a termination condition. No public exploit identified at time of analysis, but the issue is trivially reproducible and a fixed version 0.21 has been released on CPAN.
Technical ContextAI
Net::CIDR::Set is a CPAN Perl module by Andy Armstrong (currently maintained under the rrwo namespace) that represents sets of IPv4 and IPv6 CIDR ranges and supports set operations like union, intersection, and membership tests. The add() method funnels its argument through an internal _encode() routine, which first checks whether the input matches a netmask or range syntax; if neither matches, _encode() assumes a single IP and recursively calls itself with the value formatted as a /32 (IPv4) or /128 (IPv6) netmask. Because there is no validation that the value is in fact a syntactically valid IP address, a malformed string fails the netmask check again, the function recurses again, and the cycle continues until the Perl interpreter exhausts the stack. The root cause maps to CWE-1287 (Improper Validation of Specified Type of Input), where the code trusts that the input conforms to a category (IP address) without verifying it.
RemediationAI
Upgrade to Net::CIDR::Set 0.21 or later from CPAN (vendor-released patch: 0.21), which adds proper IP address validation in _encode() before recursing; the release notes are at https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changes and the coordination advisory is at https://seclists.org/oss-sec/2026/q2/815. If immediate upgrade is not possible, wrap every external call to Net::CIDR::Set->add() with a strict IPv4/IPv6 syntactic validator (for example Net::IP, Data::Validate::IP, or a strict regex) and reject malformed input before it reaches the module, accepting the trade-off that custom validation may diverge from the module's eventual canonical parsing. As an additional containment measure, run Perl workers with a bounded stack or under a supervisor that recycles processes on crash, recognising this only limits blast radius rather than fixing the underlying recursion.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today