metacpan.orgrelease notes
https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changes CVE-2026-49940
MEDIUM
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks
Record summary
CVE-2026-49940 has a selected CVSS score of 6.5 (medium).
Description
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers. This could allow network masks to accept larger networks.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 4, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Net::CIDR::SetBrowse RRWO / Net::CIDR::SetDefault status: unaffected | CVE List | Through 0.20 | affected |
References
3nvd.nist.govrelated
https://nvd.nist.gov/vuln/detail/CVE-2025-40911 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-49940