CVE-2026-40198

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40198", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-04-09T22:12:06.334Z", "datePublished": "2026-04-10T21:42:06.835Z", "dateUpdated": "2026-04-13T14:41:59.967Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-CIDR-Lite", "product": "Net::CIDR::Lite", "programFiles": ["Lite.pm"], "programRoutines": [{"name": "Net::CIDR::Lite::_pack_ipv6"}], "repo": "https://github.com/stigtsp/Net-CIDR-Lite", "vendor": "STIGTSP", "versions": [{"lessThan": "0.23", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.\n\n_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like \"abcd\", \"1:2:3\", or \"1:2:3:4:5:6:7\" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).\n\nThe packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.\n\nExample:\n\n my $cidr = Net::CIDR::Lite->new(\"::/8\");\n $cidr->find(\"1:2:3\"); # invalid input, incorrectly returns true\n\nThis is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.\n\nSee also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1286", "description": "CWE-1286 Improper Validation of Syntactic Correctness of Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-10T21:42:06.835Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/stigtsp/Net-CIDR-Lite/commit/25d65f85dbe4885959a10471725ec9d250a589c3.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-40199"}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.23 or newer, or apply the patch provided."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-04-09T00:00:00.000Z", "value": "Vulnerability found"}, {"lang": "en", "time": "2026-04-10T00:00:00.000Z", "value": "Net-CIDR-Lite version 0.23 released"}], "title": "Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T14:41:19.772152Z", "id": "CVE-2026-40198", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T14:41:59.967Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-40198", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T14:41:19.772152Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T14:41:32.534Z"}}], "cna": {"title": "Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/stigtsp/Net-CIDR-Lite", "vendor": "STIGTSP", "product": "Net::CIDR::Lite", "versions": [{"status": "affected", "version": "0", "lessThan": "0.23", "versionType": "custom"}], "packageName": "Net-CIDR-Lite", "programFiles": ["Lite.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::CIDR::Lite::_pack_ipv6"}]}], "timeline": [{"lang": "en", "time": "2026-04-09T00:00:00.000Z", "value": "Vulnerability found"}, {"lang": "en", "time": "2026-04-10T00:00:00.000Z", "value": "Net-CIDR-Lite version 0.23 released"}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.23 or newer, or apply the patch provided."}], "references": [{"url": "https://github.com/stigtsp/Net-CIDR-Lite/commit/25d65f85dbe4885959a10471725ec9d250a589c3.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes", "tags": ["release-notes"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-40199", "tags": ["related"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.\n\n_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like \"abcd\", \"1:2:3\", or \"1:2:3:4:5:6:7\" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).\n\nThe packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.\n\nExample:\n\n my $cidr = Net::CIDR::Lite->new(\"::/8\");\n $cidr->find(\"1:2:3\"); # invalid input, incorrectly returns true\n\nThis is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.\n\nSee also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1286", "description": "CWE-1286 Improper Validation of Syntactic Correctness of Input"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-10T21:42:06.835Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40198", "state": "PUBLISHED", "dateUpdated": "2026-04-13T14:41:59.967Z", "dateReserved": "2026-04-09T22:12:06.334Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-04-10T21:42:06.835Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-CIDR-Lite", "product": "Net::CIDR::Lite", "programFiles": ["Lite.pm"], "programRoutines": [{"name": "Net::CIDR::Lite::_pack_ipv6"}], "repo": "https://github.com/stigtsp/Net-CIDR-Lite", "vendor": "STIGTSP", "versions": [{"lessThan": "0.23", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:stigtsp:net\\:\\:cidr\\:\\:lite:*:*:*:*:*:perl:*:*", "matchCriteriaId": "2B8C0BC5-5E3C-4399-9FD6-437BFF65130F", "versionEndExcluding": "0.23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.\n\n_pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like \"abcd\", \"1:2:3\", or \"1:2:3:4:5:6:7\" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17).\n\nThe packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range.\n\nExample:\n\n my $cidr = Net::CIDR::Lite->new(\"::/8\");\n $cidr->find(\"1:2:3\"); # invalid input, incorrectly returns true\n\nThis is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module.\n\nSee also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses."}, {"lang": "es", "value": "Las versiones de Net::CIDR::Lite anteriores a la 0.23 para Perl no validan el recuento de grupos IPv6, lo que puede permitir la omisi\u00f3n de ACL de IP.\n\n_pack_ipv6() no comprueba que las direcciones IPv6 sin comprimir (sin ::) tengan exactamente 8 grupos hexadecimales. Entradas como \u2019abcd\u2019, \u20191:2:3\u2019 o \u20191:2:3:4:5:6:7\u2019 son aceptadas y producen valores empaquetados de longitud incorrecta (3, 7 o 15 bytes en lugar de 17).\n\nLos valores empaquetados se utilizan internamente para operaciones de m\u00e1scara y comparaci\u00f3n. find() y bin_find() utilizan la comparaci\u00f3n de cadenas de Perl (lt/gt) en estos valores, y comparar cadenas de diferentes longitudes produce resultados incorrectos. Esto puede hacer que find() informe incorrectamente una direcci\u00f3n como dentro o fuera de un rango.\n\nEjemplo:\n\n my $cidr = Net::CIDR::Lite -> new(\u2019::/8\u2019);\n $cidr -> find(\u20191:2:3\u2019); # entrada inv\u00e1lida, devuelve true incorrectamente\n\nEsta es la misma clase de problema de validaci\u00f3n de entrada que CVE-2021-47154 (ceros iniciales de IPv4) corregido previamente en este m\u00f3dulo.\n\nV\u00e9ase tambi\u00e9n CVE-2026-40199, un problema relacionado en la misma funci\u00f3n que afecta a las direcciones IPv6 mapeadas a IPv4."}], "id": "CVE-2026-40198", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40198", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T14:41:19.772152Z", "version": "2.0.3"}}]}, "published": "2026-04-10T22:16:21.463", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Patch"], "url": "https://github.com/stigtsp/Net-CIDR-Lite/commit/25d65f85dbe4885959a10471725ec9d250a589c3.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"], "url": "https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-40199"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1286"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.23)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Net::CIDR::Lite", "source": "cna", "vendor": "STIGTSP"}, "product": "net::cidr::lite", "vendor": "stigtsp"}], "analysis": {"en": {"generated_at": "2026-04-13T16:28:40.819986+00:00", "value": {"mitigation_remediation": ["Upgrade Net::CIDR::Lite to version 0.23 or newer.", "If upgrading is not immediately possible, apply the patch at https://github.com/stigtsp/Net-CIDR-Lite/commit/25d65f85dbe4885959a10471725ec9d250a589c3.patch.", "Verify that your applications properly validate IPv6 addresses before passing them to the module."], "summary": {"action": "Patch", "impact": "IP Access Control List Bypass"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in the Net::CIDR::Lite Perl module provided by STIGTSP. All releases before version 0.23 are affected; version 0.23 and newer include the validation fix.", "description_and_impact": "Net::CIDR::Lite fails to validate the number of groups in an uncompressed IPv6 address. When strings such as \"1:2:3\" are parsed, the library produces packed values that are shorter than the required 17 bytes. These malformed values are later used for mask and comparison logic. Because Perl string comparison on differing lengths yields incorrect results, the module may mistakenly report that an address is inside or outside a CIDR range, allowing unauthorized traffic to pass ACL checks.", "risk_and_exploitability": "The CVSS score of 7.5 marks the issue as high severity, but the EPSS score below 1% indicates a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits. Attackers would need to supply crafted IPv6 addresses to a Perl application that uses this module for ACL enforcement, so the attack vector is largely application\u2011level input injection."}}}}, "created": "2026-04-13T12:42:28.421870+00:00", "updated": "2026-04-14T16:36:18.347649+00:00", "vendors": ["stigtsp", "stigtsp$PRODUCT$net::cidr::lite"]}