CVE-2026-40198

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass. _pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17). The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range. Example: my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module. See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.

• CWE-1286

• https://github.com/stigtsp/Net-CIDR-Lite/commit/25d65f85dbe4885959a10471725ec9d250a589c3.patchPatch
• https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changesRelease Notes
• https://www.cve.org/CVERecord?id=CVE-2026-40199Third Party Advisory

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40192Pillow is a Python imaging library. Versions 10.3.0 through …7.5
• CVE-2026-40193maddy is a composable, all-in-one mail server. Versions prio…8.2
• CVE-2026-40194phpseclib is a PHP secure communications library. Starting i…3.7
• CVE-2026-40195Incus is a system container and virtual machine manager. In …6.5
• CVE-2026-40196HomeBox is a home inventory and organization system. Version…8.1
• CVE-2026-40197Incus is a system container and virtual machine manager. In …6.5
• CVE-2026-40199Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv…6.5
• CVE-2026-4020The Gravity SMTP plugin for WordPress is vulnerable to Sensi…7.5
• CVE-2026-40200An issue was discovered in musl libc 0.7.10 through 1.2.6. S…8.1
• CVE-2026-40201@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 al…5.4
• CVE-2026-40208An attacker might be able to delay the processing of DoH3 qu…3.7
• CVE-2026-40209An attacker might be able to cause outgoing TCP connections …5.3