Description
Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses.
Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation.
Net::CIDR::Set used code from Net::CIDR::Lite, which had a similar vulnerability CVE-2021-47154.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| RRWO | Net::CIDR::Set | 0.10 – ≤ 0.13 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libnet-cidr-set-perl | 0.15-1 | — |
| Debian 13 | libnet-cidr-set-perl | 0.15-1 | — |
| Debian 12 | libnet-cidr-set-perl | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | libnet-cidr-set-perl | No fix yet | — |
| Ubuntu 24.04 LTS | libnet-cidr-set-perl | No fix yet | — |
| Ubuntu 22.04 LTS | libnet-cidr-set-perl | No fix yet | — |
| Ubuntu 20.04 LTS | libnet-cidr-set-perl | No fix yet | — |