Description
Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.
Mask forms like "/00" and "/01" pass validation and parse to the same prefix as their unpadded value.
See also CVE-2026-45190.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| STIGTSP | Net::CIDR::Lite | < 0.24 | 0.24 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libnet-cidr-lite-perl | 0.24-1 | — |
| Debian 13 | libnet-cidr-lite-perl | 0.22-3~deb13u2 | — |
| Debian 12 | libnet-cidr-lite-perl | 0.22-3~deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | libnet-cidr-lite-perl | 0.22-2ubuntu0.26.04.2 | USN-8453-1 |
| Ubuntu 25.10 | libnet-cidr-lite-perl | 0.22-2ubuntu0.25.10.2 | USN-8453-1 |
| Ubuntu 24.04 LTS | libnet-cidr-lite-perl | 0.22-2ubuntu0.24.04.2 | USN-8453-1 |
| Ubuntu 22.04 LTS | libnet-cidr-lite-perl | 0.22-1ubuntu0.2 | USN-8453-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libnet-cidr-lite-perl | 0.21-2ubuntu0.1+esm2 | USN-8453-1 |
| Ubuntu Pro 18.04 LTS | libnet-cidr-lite-perl | 0.21-1ubuntu0.18.04.1~esm2 | USN-8453-1 |
| Ubuntu Pro 16.04 LTS | libnet-cidr-lite-perl | 0.21-1ubuntu0.16.04.1~esm2 | USN-8453-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl-Net-CIDR-Lite | 0.240.0-1.1 | openSUSE-SU-2026:10780-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | perl-net-cidr-lite | 0.24-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | perl-Net-CIDR-Lite | 0.22-8.amzn2023.0.2 | ALAS2023-2026-1732 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | perl-Net-CIDR-Lite | No fix yet | — |
Advisories 3
- USN-8453-1 libnet-cidr-lite-perl vulnerabilities Ubuntu Security Notices (USN) · Jun 18, 2026
- ALAS2023-2026-1732 Moderate: perl-Net-CIDR-Lite security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
- openSUSE-SU-2026:10780-1 perl-Net-CIDR-Lite-0.240.0-1.1 on GA media SUSE / openSUSE Security Updates · May 15, 2026