CVE-2026-45191: medium-severity vulnerability in STIGTSP Net::CIDR::Lite
Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A vulnerability in Net::CIDR::Lite allows attackers to bypass IP access controls by using padded zero characters in CIDR notation (like /00 instead of /0). This happens because the library doesn't properly validate these malformed mask values, treating them the same as legitimate ones.
Net::CIDR::Lite before 0.24 fails to normalize CIDR mask values with extraneous leading zeros, allowing an attacker to craft CIDR blocks with padded notation (/00, /01) that parse identically to unpadded values but may evade IP ACL validation. This enables IP-based access control bypass where blacklist or whitelist rules can be circumvented through alternative CIDR representations.
In the same product, most dangerous first.