CVE catalog

CVE-2026-40199

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. _pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.31% · Oct 25, 2026

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. _pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address. The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses. Example: my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x). See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibnet-cidr-lite-perlsid0.24-1fixed
Debianlibnet-cidr-lite-perlforky0.24-1fixed
Debianlibnet-cidr-lite-perltrixie0.22-3~deb13u2fixed
Debianlibnet-cidr-lite-perlbookworm0.22-3~deb12u2fixed
Cpelibnet-cidr-lite-perlNot reported0.22-2ubuntu0.24.04.1fixed
Cpenet\Not reported0.23fixed
Alpineperl-net-cidr-lite3.210.23-r0fixed
Alpineperl-net-cidr-lite3.220.23-r0fixed
Alpineperl-net-cidr-lite3.230.23-r0fixed
Alpineperl-net-cidr-lite3.240.23-r0fixed
Ubuntulibnet-cidr-lite-perlpro0.21-2vulnerable
Ubuntulibnet-cidr-lite-perlpro0.21-2ubuntu0.1vulnerable
Ubuntulibnet-cidr-lite-perlpro0.21-2ubuntu0.1+esm1fixed
Ubuntulibnet-cidr-lite-perl22.040.22-1vulnerable
Ubuntulibnet-cidr-lite-perl22.040.22-1ubuntu0.1fixed
Ubuntulibnet-cidr-lite-perl24.040.22-2vulnerable
Ubuntulibnet-cidr-lite-perl24.040.22-2ubuntu0.24.04.1fixed
Ubuntulibnet-cidr-lite-perl25.100.22-2vulnerable
Ubuntulibnet-cidr-lite-perl25.100.22-2ubuntu0.25.10.1fixed
Ubuntulibnet-cidr-lite-perl26.040.22-2vulnerable
Ubuntulibnet-cidr-lite-perl26.040.22-2ubuntu0.26.04.1fixed
Cpenet\Not reported0.23fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibnet-cidr-lite-perlsourcesid0.22-3not yet assignedNot reportedNot reported
Debianlibnet-cidr-lite-perlsourceforky0.22-3not yet assignedNot reportedNot reported
Debianlibnet-cidr-lite-perlsourcetrixie0.22-3~deb13u1not yet assignedNot reportedNot reported
Debianlibnet-cidr-lite-perlsourcebookworm0.22-3~deb12u1not yet assignedNot reportedNot reported
Cpelibnet-cidr-lite-perlcpeNot reported0.22-2ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpenet\cpeNot reported0.23Not reportedNot reportedNot reported
Alpineperl-net-cidr-liteapk3.210.23-r0Not reportedALPINE-CVE-2026-40199Not reported
Alpineperl-net-cidr-liteapk3.220.23-r0Not reportedALPINE-CVE-2026-40199Not reported
Alpineperl-net-cidr-liteapk3.230.23-r0Not reportedALPINE-CVE-2026-40199Not reported
Alpineperl-net-cidr-liteapk3.240.23-r0Not reportedALPINE-CVE-2026-40199Not reported
Ubuntulibnet-cidr-lite-perldebpro0.21-2ubuntu0.1+esm1Not reportedUBUNTU-CVE-2026-40199Not reported
Ubuntulibnet-cidr-lite-perldeb22.040.22-1ubuntu0.1Not reportedUBUNTU-CVE-2026-40199Not reported
Ubuntulibnet-cidr-lite-perldeb24.040.22-2ubuntu0.24.04.1Not reportedUBUNTU-CVE-2026-40199Not reported
Ubuntulibnet-cidr-lite-perldeb25.100.22-2ubuntu0.25.10.1Not reportedUBUNTU-CVE-2026-40199Not reported
Ubuntulibnet-cidr-lite-perldeb26.040.22-2ubuntu0.26.04.1Not reportedUBUNTU-CVE-2026-40199Not reported
Cpenet\cpeNot reported0.23Not reportedNVD-CVE-2026-40199Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libnet-cidr-lite-perl]Fixed
    Details (2)

    • 0.22-3~deb12u2 · all · bookworm

      Fixed · Fixed: 0.22-3~deb12u1

      nvd · libnet-cidr-lite-perl · debian · bookworm; nvd · libnet-cidr-lite-perl · debian · 12

    • 0.22-3~deb12u2 · all · bookworm

      Fixed · Fixed: 0.22-3~deb12u1

      nvd · libnet-cidr-lite-perl · debian · bookworm; nvd · libnet-cidr-lite-perl · debian · 12

[Debian 13 (Trixie)]

  • [libnet-cidr-lite-perl]Fixed
    Details (2)

    • 0.22-3~deb13u2 · all · trixie

      Fixed · Fixed: 0.22-3~deb13u1

      nvd · libnet-cidr-lite-perl · debian · 13

    • 0.22-3~deb13u2 · all · trixie

      Fixed · Fixed: 0.22-3~deb13u1

      nvd · libnet-cidr-lite-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]