The add method called the _encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and passed back to itself as a 32-bit or 128-bit netmask.
If the argument was not a well-formed IP address, then this would lead to indefinite recursion.
An attacker could use this to cause a denial of service.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| RRWO | Net::CIDR::Set | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to version 0.21 of later.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changes |
|
Thu, 04 Jun 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Thu, 04 Jun 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. The add method called the _encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and passed back to itself as a 32-bit or 128-bit netmask. If the argument was not a well-formed IP address, then this would lead to indefinite recursion. An attacker could use this to cause a denial of service. | |
| Title | Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses | |
| Weaknesses | CWE-1287 CWE-674 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-06-04T18:45:40.658Z
Reserved: 2026-06-02T16:06:23.069Z
Link: CVE-2026-49941
Vulnrichment
Updated: 2026-06-04T17:51:05.884Z
NVD
Status : Undergoing Analysis
Published: 2026-06-04T17:16:33.173
Modified: 2026-06-04T19:16:30.393
Link: CVE-2026-49941
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-06-04T19:30:21Z