CVE-2026-40198

{"id": "CVE-2026-40198", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40198", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T14:41:19.772152Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/stigtsp/Net-CIDR-Lite", "vendor": "STIGTSP", "product": "Net::CIDR::Lite", "versions": [{"status": "affected", "version": "0", "lessThan": "0.23", "versionType": "custom"}], "packageName": "Net-CIDR-Lite", "programFiles": ["Lite.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::CIDR::Lite::_pack_ipv6"}]}]}], "published": "2026-04-10T22:16:21.463", "references": [{"url": "https://github.com/stigtsp/Net-CIDR-Lite/commit/25d65f85dbe4885959a10471725ec9d250a589c3.patch", "tags": ["Patch"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes", "tags": ["Release Notes"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-40199", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-1286"}]}], "descriptions": [{"lang": "en", "value": "Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.\n\n_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like \"abcd\", \"1:2:3\", or \"1:2:3:4:5:6:7\" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).\n\nThe packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.\n\nExample:\n\n my $cidr = Net::CIDR::Lite->new(\"::/8\");\n $cidr->find(\"1:2:3\"); # invalid input, incorrectly returns true\n\nThis is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.\n\nSee also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses."}, {"lang": "es", "value": "Las versiones de Net::CIDR::Lite anteriores a la 0.23 para Perl no validan el recuento de grupos IPv6, lo que puede permitir la omisi\u00f3n de ACL de IP.\n\n_pack_ipv6() no comprueba que las direcciones IPv6 sin comprimir (sin ::) tengan exactamente 8 grupos hexadecimales. Entradas como \u2019abcd\u2019, \u20191:2:3\u2019 o \u20191:2:3:4:5:6:7\u2019 son aceptadas y producen valores empaquetados de longitud incorrecta (3, 7 o 15 bytes en lugar de 17).\n\nLos valores empaquetados se utilizan internamente para operaciones de m\u00e1scara y comparaci\u00f3n. find() y bin_find() utilizan la comparaci\u00f3n de cadenas de Perl (lt/gt) en estos valores, y comparar cadenas de diferentes longitudes produce resultados incorrectos. Esto puede hacer que find() informe incorrectamente una direcci\u00f3n como dentro o fuera de un rango.\n\nEjemplo:\n\n my $cidr = Net::CIDR::Lite -> new(\u2019::/8\u2019);\n $cidr -> find(\u20191:2:3\u2019); # entrada inv\u00e1lida, devuelve true incorrectamente\n\nEsta es la misma clase de problema de validaci\u00f3n de entrada que CVE-2021-47154 (ceros iniciales de IPv4) corregido previamente en este m\u00f3dulo.\n\nV\u00e9ase tambi\u00e9n CVE-2026-40199, un problema relacionado en la misma funci\u00f3n que afecta a las direcciones IPv6 mapeadas a IPv4."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:stigtsp:net\\:\\:cidr\\:\\:lite:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "2B8C0BC5-5E3C-4399-9FD6-437BFF65130F", "versionEndExcluding": "0.23"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}