CVE-2026-49942

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49942", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-06-02T16:06:23.069Z", "datePublished": "2026-06-04T16:07:42.179Z", "dateUpdated": "2026-06-04T17:45:48.065Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-CIDR-Set", "product": "Net::CIDR::Set", "programRoutines": [{"name": "Net::CIDR::Set::IPv4::_encode"}, {"name": "Net::CIDR::Set::IPv6::_encode"}], "repo": "https://github.com/robrwo/perl-Net-CIDR-Set", "vendor": "RRWO", "versions": [{"lessThanOrEqual": "0.20", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Net::CIDR::Set versions through 0.20 for Perl did not validate network masks.\n\nThe mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks.\n\nLeading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1289", "description": "CWE-1289 Improper Validation of Unsafe Equivalence in Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-04T16:07:42.179Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changes"}, {"tags": ["related"], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40911"}, {"tags": ["related"], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45191"}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.21."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-05-13T00:00:00.000Z", "value": "Issue reported to CPANSec"}, {"lang": "en", "time": "2026-06-02T00:00:00.000Z", "value": "Net::CIDR::Set version 0.21 released with fix"}], "title": "Net::CIDR::Set versions through 0.20 for Perl did not validate network masks", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T17:42:08.928858Z", "id": "CVE-2026-49942", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T17:45:48.065Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-49942", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T17:42:08.928858Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T17:41:09.267Z"}}], "cna": {"title": "Net::CIDR::Set versions through 0.20 for Perl did not validate network masks", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/robrwo/perl-Net-CIDR-Set", "vendor": "RRWO", "product": "Net::CIDR::Set", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.20"}], "packageName": "Net-CIDR-Set", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::CIDR::Set::IPv4::_encode"}, {"name": "Net::CIDR::Set::IPv6::_encode"}]}], "timeline": [{"lang": "en", "time": "2026-05-13T00:00:00.000Z", "value": "Issue reported to CPANSec"}, {"lang": "en", "time": "2026-06-02T00:00:00.000Z", "value": "Net::CIDR::Set version 0.21 released with fix"}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.21."}], "references": [{"url": "https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changes", "tags": ["release-notes"]}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40911", "tags": ["related"]}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45191", "tags": ["related"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Net::CIDR::Set versions through 0.20 for Perl did not validate network masks.\n\nThe mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks.\n\nLeading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1289", "description": "CWE-1289 Improper Validation of Unsafe Equivalence in Input"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-04T16:07:42.179Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49942", "state": "PUBLISHED", "dateUpdated": "2026-06-04T17:45:48.065Z", "dateReserved": "2026-06-02T16:06:23.069Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-06-04T16:07:42.179Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-CIDR-Set", "product": "Net::CIDR::Set", "programRoutines": [{"name": "Net::CIDR::Set::IPv4::_encode"}, {"name": "Net::CIDR::Set::IPv6::_encode"}], "repo": "https://github.com/robrwo/perl-Net-CIDR-Set", "vendor": "RRWO", "versions": [{"lessThanOrEqual": "0.20", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rrwo:net\\:\\:cidr\\:\\:set:*:*:*:*:*:perl:*:*", "matchCriteriaId": "24C7BD24-8729-408F-BD1D-F8F0608DFE50", "versionEndExcluding": "0.21", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Net::CIDR::Set versions through 0.20 for Perl did not validate network masks.\n\nThe mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks.\n\nLeading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable."}, {"lang": "es", "value": "Las versiones de Net::CIDR::Set hasta la 0.20 para Perl no validaban las m\u00e1scaras de red.\n\nLa porci\u00f3n de m\u00e1scara de una m\u00e1scara de red pod\u00eda contener d\u00edgitos Unicode como el Uno ar\u00e1bigo-\u00edndico (U+0661), o no-d\u00edgitos, los cuales eran ignorados. Esto podr\u00eda permitir a las m\u00e1scaras de red aceptar redes m\u00e1s grandes.\n\nLos ceros iniciales tambi\u00e9n eran aceptados, pero tratados como decimal en lugar de octal. Esto podr\u00eda llevar a confusi\u00f3n sobre qu\u00e9 redes son aceptables."}], "id": "CVE-2026-49942", "lastModified": "2026-07-22T20:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49942", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-04T17:42:08.928858Z", "version": "2.0.3"}}]}, "published": "2026-06-04T17:16:33.283", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"], "url": "https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40911"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45191"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1289"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.20]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Net::CIDR::Set", "source": "cna", "vendor": "RRWO"}, "product": "net::cidr::set", "vendor": "rrwo"}], "created": "2026-06-04T18:00:13.435079+00:00", "updated": "2026-06-05T10:07:28.534164+00:00", "vendors": ["rrwo", "rrwo$PRODUCT$net::cidr::set"]}