CVE-2026-49940
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Jun 4, 2026
CISA due date
—
The record
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers. This could allow network masks to accept larger networks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | perl-Net-CIDR-Set | 0 | 0.210.0-1.1 |
Related vulnerabilities
- CVE-2026-49941 Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. Also affects perl-Net-CIDR-Set
- CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. CWE-1289
- CVE-2026-89049 A server-side request forgery issue due to improper validation of equivalent address… CWE-1289
- CVE-2026-76977 SAP UI5 does not sufficiently validate the parent frame's origin against the configured… CWE-1289
- CVE-2026-74994 The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia… CWE-1289
- CVE-2026-19953 URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode… CWE-1289
- CVE-2026-60074 Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal… CWE-1289
- CVE-2026-42462 Fedify is a TypeScript library for building federated server apps powered by ActivityPub. CWE-1289