CVE-2026-49940: medium-severity vulnerability in RRWO Net::CIDR::Set
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Net::CIDR::Set, a Perl library for managing IP address ranges, incorrectly accepts Unicode digits (like Arabic numerals) instead of standard ASCII digits. This flaw allows attackers to bypass network restrictions by crafting IP addresses that parse differently than intended.
Net::CIDR::Set ≤0.20 fails to validate and properly parse non-ASCII Unicode digits in IP addresses and netmasks. An attacker can supply crafted input using characters like U+0661 (Arabic-Indic One) which are accepted but misinterpreted during parsing, resulting in incorrect CIDR range calculations and potential network access control bypass.
In the same product, most dangerous first.