CVE-2026-49942

Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks. Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changes	Release Notes
https://nvd.nist.gov/vuln/detail/CVE-2025-40911	Third Party Advisory US Government Resource
https://nvd.nist.gov/vuln/detail/CVE-2026-45191	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:rrwo:net\:\:cidr\:\:set:*:*:*:*:*:perl:*:*

History

No history.

Information

Published : 2026-06-04 17:16

Updated : 2026-07-22 20:10

NVD link : CVE-2026-49942

Mitre link : CVE-2026-49942

CVE.ORG link : CVE-2026-49942

JSON object : View

Products Affected

rrwo

net\

CWE

CWE-1289

Improper Validation of Unsafe Equivalence in Input

{"id": "CVE-2026-49942", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49942", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T17:42:08.928858Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/robrwo/perl-Net-CIDR-Set", "vendor": "RRWO", "product": "Net::CIDR::Set", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.20"}], "packageName": "Net-CIDR-Set", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::CIDR::Set::IPv4::_encode"}, {"name": "Net::CIDR::Set::IPv6::_encode"}]}]}], "published": "2026-06-04T17:16:33.283", "references": [{"url": "https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changes", "tags": ["Release Notes"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40911", "tags": ["Third Party Advisory", "US Government Resource"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45191", "tags": ["Third Party Advisory", "US Government Resource"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-1289"}]}], "descriptions": [{"lang": "en", "value": "Net::CIDR::Set versions through 0.20 for Perl did not validate network masks.\n\nThe mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks.\n\nLeading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable."}, {"lang": "es", "value": "Las versiones de Net::CIDR::Set hasta la 0.20 para Perl no validaban las m\u00e1scaras de red.\n\nLa porci\u00f3n de m\u00e1scara de una m\u00e1scara de red pod\u00eda contener d\u00edgitos Unicode como el Uno ar\u00e1bigo-\u00edndico (U+0661), o no-d\u00edgitos, los cuales eran ignorados. Esto podr\u00eda permitir a las m\u00e1scaras de red aceptar redes m\u00e1s grandes.\n\nLos ceros iniciales tambi\u00e9n eran aceptados, pero tratados como decimal en lugar de octal. Esto podr\u00eda llevar a confusi\u00f3n sobre qu\u00e9 redes son aceptables."}], "lastModified": "2026-07-22T20:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rrwo:net\\:\\:cidr\\:\\:set:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "24C7BD24-8729-408F-BD1D-F8F0608DFE50", "versionEndExcluding": "0.21"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}