CVE-2026-49942: high-severity vulnerability in RRWO Net::CIDR::Set
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Net::CIDR::Set, a Perl library for managing network ranges, accepted invalid network masks using Unicode digits and leading zeros, allowing it to incorrectly interpret which networks should be allowed. This could cause security policies that restrict network access to fail silently.
Net::CIDR::Set versions ≤0.20 fail to validate network mask notation, accepting Unicode digit characters (e.g., Arabic-Indic digits U+0661) and non-digit characters that are silently ignored, as well as treating leading zeros as decimal rather than octal. An attacker can craft malformed CIDR masks that bypass intended network access controls or cause unexpected network range interpretations in security policies relying on this library.
In the same product, most dangerous first.