CVE-2026-45191
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
May 10, 2026
CISA due date
—
The record
Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass. Mask forms like "/00" and "/01" pass validation and parse to the same prefix as their unpadded value. See also CVE-2026-45190.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | perl-Net-CIDR-Lite | 0 | 0.240.0-1.1 |
Related vulnerabilities
- CVE-2026-45190 Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and… Also affects perl-Net-CIDR-Lite
- CVE-2026-40199 Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses… Also affects perl-Net-CIDR-Lite
- CVE-2026-40198 Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which… Also affects perl-Net-CIDR-Lite
- CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. CWE-1289
- CVE-2026-89049 A server-side request forgery issue due to improper validation of equivalent address… CWE-1289
- CVE-2026-76977 SAP UI5 does not sufficiently validate the parent frame's origin against the configured… CWE-1289
- CVE-2026-74994 The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia… CWE-1289
- CVE-2026-19953 URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode… CWE-1289