CVE-2026-49942: Net::CIDR::Set versions through 0.20 for Perl did not validate network masks

Synopsis

An input-validation flaw in Net::CIDR::Set (versions through 0.20 for Perl) allows malformed network mask values, including Unicode digits and leading zeros, to be silently accepted and misinterpreted. The vulnerability is reachable over the network with no authentication required, meaning any unauthenticated caller who can supply CIDR input to an application using this library can trigger the behavior. Successful exploitation lets an attacker bypass IP-allowlist or blocklist logic, read data or reach services that should have been excluded, tamper with access decisions, and cause inconsistent routing behavior. HarborGuard is tracking the advisory for patch availability, as no fix version has been published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable library is exposed over the network; an attacker must be able to send crafted CIDR input to the affected service remotely.

• AuthenticationNot required

  No credentials or prior account are needed to supply malformed mask values to the affected service.

• Victim interactionNot required

  The flaw is triggered by the attacker submitting crafted input directly; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply includes Unicode digits or leading zeros in the mask portion of a CIDR string.

Blast Radius

• An attacker can bypass IP-based access controls, gaining read access to data or services that should have been restricted by a blocklist or allowlist.
• An attacker can cause the application to accept network ranges larger than intended, allowing unauthorized hosts to pass firewall or routing rules.
• An attacker can introduce confusion between decimal and octal interpretations of leading-zero masks, silently corrupting access-control decisions.
• The mismatch between accepted and intended network ranges can degrade service reliability or produce inconsistent behavior across deployments.