CVE-2026-19566

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19566", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-08-11T18:53:07.963Z", "datePublished": "2026-08-12T08:39:59.029Z", "dateUpdated": "2026-08-12T19:49:32.903Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-CIDR-Set", "product": "Net::CIDR::Set", "programFiles": ["lib/Net/CIDR/Set/IPv6.pm", "lib/Net/CIDR/Set.pm"], "programRoutines": [{"name": "Net::CIDR::Set::IPv6::_encode"}, {"name": "Net::CIDR::Set::IPv6::_width2bits"}], "repo": "https://github.com/robrwo/perl-Net-CIDR-Set", "vendor": "RRWO", "versions": [{"lessThan": "0.23", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths.\n\nThe _encode method accepts any prefix length matching `(0|[1-9][0-9]*)` and passes it to _width2bits(), which builds the mask as `'1' x ($width + 8)`, one character per bit. The _inc() method then unpacks the packed mask into a Perl array of one scalar per byte, so the prefix length alone sets the allocation size: `::/100000000` builds a 100 MB string and a 12.5 million element array. The value being tested is parsed, not just the configured ranges: contains() builds a set from its argument, and _guess_coder() tries the IPv4 coder and then the IPv6 coder, so an IPv4-only set expands an oversized IPv6 prefix length before the mixed address width check rejects it.\n\nAny caller that passes untrusted input to contains() or add() can exhaust process memory. A prefix length above 128 is also stored as a range that does not match the requested block: 2001:db8::/129 stringifies back unchanged, contains() of its own base address returns false, and removing it from a set drops the base address while the set still prints as covering it."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-08-12T08:39:59.029Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://github.com/robrwo/perl-Net-CIDR-Set/security/advisories/GHSA-grjr-r4x5-mx4p"}, {"tags": ["patch"], "url": "https://github.com/robrwo/perl-Net-CIDR-Set/commit/e16b27db676fd1ca671fbb31208a22c1b1ba9724.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/RRWO/Net-CIDR-Set-0.23/changes"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-49942"}], "solutions": [{"lang": "en", "value": "Upgrade to Net::CIDR::Set version 0.23 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths", "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade, apply the patch."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T19:49:22.654200Z", "id": "CVE-2026-19566", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T19:49:32.903Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-19566", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T19:49:22.654200Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T19:49:30.358Z"}}], "cna": {"title": "Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/robrwo/perl-Net-CIDR-Set", "vendor": "RRWO", "product": "Net::CIDR::Set", "versions": [{"status": "affected", "version": "0", "lessThan": "0.23", "versionType": "custom"}], "packageName": "Net-CIDR-Set", "programFiles": ["lib/Net/CIDR/Set/IPv6.pm", "lib/Net/CIDR/Set.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::CIDR::Set::IPv6::_encode"}, {"name": "Net::CIDR::Set::IPv6::_width2bits"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Net::CIDR::Set version 0.23 or later."}], "references": [{"url": "https://github.com/robrwo/perl-Net-CIDR-Set/security/advisories/GHSA-grjr-r4x5-mx4p", "tags": ["vendor-advisory"]}, {"url": "https://github.com/robrwo/perl-Net-CIDR-Set/commit/e16b27db676fd1ca671fbb31208a22c1b1ba9724.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/RRWO/Net-CIDR-Set-0.23/changes", "tags": ["release-notes"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-49942", "tags": ["related"]}], "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade, apply the patch."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths.\n\nThe _encode method accepts any prefix length matching `(0|[1-9][0-9]*)` and passes it to _width2bits(), which builds the mask as `'1' x ($width + 8)`, one character per bit. The _inc() method then unpacks the packed mask into a Perl array of one scalar per byte, so the prefix length alone sets the allocation size: `::/100000000` builds a 100 MB string and a 12.5 million element array. The value being tested is parsed, not just the configured ranges: contains() builds a set from its argument, and _guess_coder() tries the IPv4 coder and then the IPv6 coder, so an IPv4-only set expands an oversized IPv6 prefix length before the mixed address width check rejects it.\n\nAny caller that passes untrusted input to contains() or add() can exhaust process memory. A prefix length above 128 is also stored as a range that does not match the requested block: 2001:db8::/129 stringifies back unchanged, contains() of its own base address returns false, and removing it from a set drops the base address while the set still prints as covering it."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-08-12T08:39:59.029Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19566", "state": "PUBLISHED", "dateUpdated": "2026-08-12T19:49:32.903Z", "dateReserved": "2026-08-11T18:53:07.963Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-08-12T08:39:59.029Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-CIDR-Set", "product": "Net::CIDR::Set", "programFiles": ["lib/Net/CIDR/Set/IPv6.pm", "lib/Net/CIDR/Set.pm"], "programRoutines": [{"name": "Net::CIDR::Set::IPv6::_encode"}, {"name": "Net::CIDR::Set::IPv6::_width2bits"}], "repo": "https://github.com/robrwo/perl-Net-CIDR-Set", "vendor": "RRWO", "versions": [{"lessThan": "0.23", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths.\n\nThe _encode method accepts any prefix length matching `(0|[1-9][0-9]*)` and passes it to _width2bits(), which builds the mask as `'1' x ($width + 8)`, one character per bit. The _inc() method then unpacks the packed mask into a Perl array of one scalar per byte, so the prefix length alone sets the allocation size: `::/100000000` builds a 100 MB string and a 12.5 million element array. The value being tested is parsed, not just the configured ranges: contains() builds a set from its argument, and _guess_coder() tries the IPv4 coder and then the IPv6 coder, so an IPv4-only set expands an oversized IPv6 prefix length before the mixed address width check rejects it.\n\nAny caller that passes untrusted input to contains() or add() can exhaust process memory. A prefix length above 128 is also stored as a range that does not match the requested block: 2001:db8::/129 stringifies back unchanged, contains() of its own base address returns false, and removing it from a set drops the base address while the set still prints as covering it."}, {"lang": "es", "value": "Versiones de Net::CIDR::Set anteriores a la 0.23 para Perl permiten el agotamiento de la memoria y rangos de conjunto mal formados a trav\u00e9s de longitudes de prefijo IPv6 ilimitadas.\n\nEl m\u00e9todo _encode acepta cualquier longitud de prefijo que coincida con \u201c(0|[1-9][0-9]*)\u201d y la pasa a _width2bits(), que construye la m\u00e1scara como \u201c\u20191\u2019 x ($width + 8)\u201d, un car\u00e1cter por bit. El m\u00e9todo _inc() luego desempaqueta la m\u00e1scara empaquetada en un array de Perl de un escalar por byte, por lo que la longitud del prefijo por s\u00ed sola establece el tama\u00f1o de asignaci\u00f3n: \u201c::/100000000\u201d construye una cadena de 100 MB y un array de 12.5 millones de elementos. El valor que se est\u00e1 probando se analiza, no solo los rangos configurados: contains() construye un conjunto a partir de su argumento, y _guess_coder() prueba el codificador IPv4 y luego el codificador IPv6, por lo que un conjunto solo IPv4 expande una longitud de prefijo IPv6 sobredimensionada antes de que la verificaci\u00f3n de ancho de direcci\u00f3n mixta lo rechace.\n\nCualquier llamador que pase entrada no confiable a contains() o add() puede agotar la memoria del proceso. Una longitud de prefijo superior a 128 tambi\u00e9n se almacena como un rango que no coincide con el bloque solicitado: 2001:db8::/129 se convierte a cadena sin cambios, contains() de su propia direcci\u00f3n base devuelve falso, y al eliminarlo de un conjunto se elimina la direcci\u00f3n base mientras que el conjunto a\u00fan se imprime como si lo cubriera."}], "id": "CVE-2026-19566", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19566", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T19:49:22.654200Z", "version": "2.0.3"}}]}, "published": "2026-08-12T09:17:29.753", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/robrwo/perl-Net-CIDR-Set/commit/e16b27db676fd1ca671fbb31208a22c1b1ba9724.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/robrwo/perl-Net-CIDR-Set/security/advisories/GHSA-grjr-r4x5-mx4p"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/RRWO/Net-CIDR-Set-0.23/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49942"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}, {"lang": "en", "value": "CWE-1284"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.23)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Net::CIDR::Set", "source": "cna", "vendor": "RRWO"}, "product": "net::cidr::set", "vendor": "rrwo"}], "created": "2026-08-12T12:00:04.000574+00:00", "updated": "2026-08-12T23:00:05.341823+00:00", "vendors": ["rrwo", "rrwo$PRODUCT$net::cidr::set"]}